Malicious Code Injection in unpleasant_rabbit-appteadev Package
Summary
MAL-2025-110180: Malicious code in unpleasant_rabbit-appteadev (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The unpleasant_rabbit-appteadev package is part of the npm ecosystem, typically used for various development purposes. However, it has been identified as part of a malicious campaign that aims to exploit npm's package publishing system. This package, like others in the campaign, is designed to inflate developer reputation scores by automatically generating and publishing derivative packages with randomized names.
Vulnerability Detail
The vulnerability originates from the malicious intent behind the package, which modifies the package.json file to remove private flags and alters version numbers. It generates random package names, often themed around Indonesian culture, and continuously republishes these variants to pollute the npm registry. This behavior can lead to a compromised development environment, where developers may unknowingly use these malicious packages, potentially exposing their applications to further vulnerabilities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall unpleasant_rabbit-appteadevIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid using the unpleasant_rabbit-appteadev package and monitor your project dependencies for any unauthorized changes. Regularly check your package-lock.json file for any unexpected modifications.
Conclusion
The unpleasant_rabbit-appteadev package poses a significant risk due to its malicious code designed to manipulate package metadata and publish unauthorized variants. Developers should take immediate action to remove this package and monitor their projects for any signs of compromise.
See every vulnerability recorded for unpleasant_rabbit-appteadev →
FAQ
The vulnerability involves malicious code that modifies package metadata and publishes unauthorized variants to the npm registry.
You can use tools like Vulert, which monitors your package-lock.json for vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
You should uninstall the package immediately using the command: npm uninstall unpleasant_rabbit-appteadev.
Yes, using this package can lead to the exposure of your application to further vulnerabilities and potentially compromise your development environment.
Currently, there is no patched version available. It is advisable to remove the package and monitor for updates.
