Malicious Code Injection in underwood-validator-catalyst: A Threat to npm Packages
Summary
MAL-2025-110068: Malicious code in underwood-validator-catalyst (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The underwood-validator-catalyst package is part of the npm ecosystem, primarily used for validation purposes in JavaScript applications. However, it has been identified as part of a malicious campaign that floods the npm registry with harmful packages. This vulnerability exposes users to risks associated with unauthorized modifications and potential data breaches.
Vulnerability Detail
The vulnerability in underwood-validator-catalyst originates from its association with the tea.xyz token reward campaign, which aims to inflate developer reputation scores through the automatic generation and publication of derivative packages. The malicious code alters the package.json file by removing private flags, changing version numbers, and creating random package names. This not only pollutes the npm registry but also compromises the integrity of applications relying on this package, potentially leading to unauthorized access and exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall underwood-validator-catalystIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the underwood-validator-catalyst package and look for alternative packages that provide similar functionality without the associated risks. Additionally, consider implementing strict package auditing in your development process.
Conclusion
The underwood-validator-catalyst package poses a significant risk due to its malicious code that alters essential project files and floods the npm registry. It is crucial for developers to remove this package and monitor their dependencies to maintain the integrity and security of their applications.
See every vulnerability recorded for underwood-validator-catalyst →
FAQ
The main issue is that it contains malicious code that modifies package.json and floods the npm registry with harmful packages.
You can check your package-lock.json file for the presence of underwood-validator-catalyst. Additionally, you can use Vulert to monitor for vulnerabilities.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using just the package-lock.json file. You can check for vulnerabilities without any installation.
Yes, regularly auditing your dependencies and using tools like Vulert can help identify and mitigate vulnerabilities before they affect your project.
If you have already used underwood-validator-catalyst, remove it from your project immediately and look for alternative packages.
