Malicious Code Injection in utomo-getuk89-miaww Package
Summary
MAL-2025-91568: Malicious code in utomo-getuk89-miaww (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The utomo-getuk89-miaww package is part of the npm ecosystem and is associated with the tea.xyz token reward campaign. This package is designed to facilitate the generation and publication of derivative packages, often with randomized names, to inflate developer reputation scores for token rewards. Its primary functionality revolves around automating the publishing process, but this has led to significant vulnerabilities due to malicious code embedded within.
Vulnerability Detail
The vulnerability in the utomo-getuk89-miaww package stems from its malicious code that modifies the package.json file to remove private flags, alters version numbers, and generates random package names. This behavior is intended to continuously republish variants, thereby polluting the npm registry. The origin of this vulnerability is linked to the package's involvement in the tea.xyz token reward campaign, which employs autopublish scripts to exploit the npm ecosystem for malicious purposes. The ramifications include potential security risks for developers who inadvertently use this package, as it can lead to unauthorized access and manipulation of their projects.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall utomo-getuk89-miawwIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can avoid using the utomo-getuk89-miaww package altogether and look for alternative packages that provide similar functionality without the associated risks. Additionally, regularly audit your npm packages using tools like Vulert to monitor for vulnerabilities. You can check if your application is affected by this vulnerability using the Vulert playground at https://vulert.com/scanner without any signup.
Conclusion
The utomo-getuk89-miaww package poses a significant security risk due to its malicious code that modifies project files and repopulates the npm registry with harmful variants. It is crucial for developers to remove this package and monitor their dependencies for vulnerabilities to maintain the integrity of their projects.
See every vulnerability recorded for utomo-getuk89-miaww →
FAQ
The utomo-getuk89-miaww package is an npm package involved in automating the publication of derivative packages, primarily associated with the tea.xyz token reward campaign.
The vulnerability can lead to unauthorized modifications in your project's package.json file, potentially compromising your project's integrity and security.
If you have installed the utomo-getuk89-miaww package, you should uninstall it immediately using the command npm uninstall utomo-getuk89-miaww.
Yes, tools like Vulert can help monitor and alert you in real-time for open-source vulnerabilities in your software. You can use the Vulert playground to check for vulnerabilities without needing to sign up.
Ignoring this vulnerability can lead to security breaches, unauthorized access to your project, and damage to your reputation as a developer.
