Malicious Code Injection in uyafu-tutdat-datut Package: A Threat to npm Ecosystem
Summary
MAL-2025-170201: Malicious code in uyafu-tutdat-datut (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The uyafu-tutdat-datut package is part of the npm ecosystem and is associated with the tea.xyz token reward campaign. This package, like others in the campaign, is designed to inflate developer reputation scores through the automatic generation and publication of derivative packages. It typically contains scripts that manipulate package metadata and publish variants with randomized names, potentially leading to registry pollution and security risks.
Vulnerability Detail
The uyafu-tutdat-datut package contains malicious code that modifies the package.json file by removing private flags and altering version numbers. It generates random package names, primarily themed around Indonesian culture, and continuously republishes these variants to the npm registry. This behavior not only compromises the integrity of the npm ecosystem but also poses risks to developers who may unknowingly use these tainted packages, leading to potential security vulnerabilities in their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall uyafu-tutdat-datutIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can prevent the installation of the uyafu-tutdat-datut package by using npm's package-lock.json file to lock your dependencies. Additionally, consider using tools like Vulert to monitor your project for vulnerabilities. You can check if your application is affected by this vulnerability using the Vulert playground at https://vulert.com/scanner without any signup.
Conclusion
The uyafu-tutdat-datut package presents a significant security risk due to its malicious code that alters package metadata and floods the npm registry with harmful variants. It is crucial for developers to remove this package from their projects and utilize monitoring tools like Vulert to safeguard against future vulnerabilities.
See every vulnerability recorded for uyafu-tutdat-datut →
FAQ
It is an npm package associated with the tea.xyz token reward campaign, designed to inflate developer reputation scores.
The malicious code can compromise your project's integrity by modifying package metadata and introducing potentially harmful variants into your dependencies.
You should uninstall the package immediately using npm uninstall uyafu-tutdat-datut and check your package-lock.json for any references.
Yes, regularly monitor your dependencies using tools like Vulert, which can alert you to open-source vulnerabilities in real-time.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without any signup.
