Malicious Code Exploit in upilka-luzimub-ilnui Package: npm Vulnerability
Summary
MAL-2025-170149: Malicious code in upilka-luzimub-ilnui (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The upilka-luzimub-ilnui package is part of the npm ecosystem, often used in JavaScript applications for various functionalities. However, it has been identified as part of a malicious campaign that floods the npm registry with derivative packages. This package is linked to the tea.xyz token reward scheme, which aims to inflate developer reputation scores through automated publishing of malicious variants.
Vulnerability Detail
The vulnerability stems from the package's malicious payload, which modifies the package.json file by removing private flags, altering version numbers, and generating random package names. This behavior leads to the continuous republishing of these variants, polluting the npm registry and potentially compromising the integrity of applications that depend on this package. The origin of this issue is tied to the tea.xyz token reward campaign, which exploits npm's publishing mechanisms.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall upilka-luzimub-ilnuiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, the best workaround is to avoid using the upilka-luzimub-ilnui package altogether. If it is already in use, ensure to remove it from your project and replace it with a trusted alternative package that provides similar functionality.
Conclusion
The upilka-luzimub-ilnui package poses a significant risk due to its malicious behavior aimed at manipulating the npm registry. It is essential to remove this package from your projects and monitor for any potential vulnerabilities in your dependencies to maintain application security.
See every vulnerability recorded for upilka-luzimub-ilnui →
FAQ
It is an npm package that has been identified as part of a malicious campaign to inflate developer reputation scores through automated publishing.
The vulnerability can lead to the pollution of the npm registry and compromise the integrity of your application by introducing malicious code.
You should uninstall the package immediately using 'npm uninstall upilka-luzimub-ilnui' and check for any dependencies that may rely on it.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just your package-lock.json file. You can check your application against vulnerabilities using the Vulert playground without any signup.
Regularly audit your dependencies, keep your packages updated, and utilize tools like Vulert to monitor for vulnerabilities.
