Malicious Code Injection in Uyeups-Devapp: A Threat to NPM Packages
Summary
MAL-2025-110311: Malicious code in uyeups-devapp (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Uyeups-Devapp is an npm package that has been implicated in a malicious campaign associated with the tea.xyz token reward system. This package is designed to facilitate the automatic generation and publication of derivative packages, which can inflate developer reputation scores. The malicious nature of this package stems from its ability to modify critical files and continuously republish variants to the npm registry, thereby polluting it.
Vulnerability Detail
The vulnerability in Uyeups-Devapp originates from its involvement in a malicious campaign that floods the npm registry with derivative packages. The package contains scripts that alter the package.json file by removing private flags, changing version numbers, and generating random package names. This behavior can lead to significant security risks, including the potential for unauthorized access to sensitive data and the proliferation of malicious software within the npm ecosystem.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall uyeups-devappIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the Uyeups-Devapp package from your project by using the command: npm uninstall uyeups-devapp. This will prevent any malicious scripts from executing while you assess the situation.
Conclusion
The Uyeups-Devapp package poses a significant security risk due to its malicious code that modifies package files and floods the npm registry. It is crucial for developers to take immediate action by updating or removing the package to protect their applications from potential threats.
See every vulnerability recorded for uyeups-devapp →
FAQ
Uyeups-Devapp is an npm package involved in a malicious campaign that generates and publishes derivative packages to inflate developer reputation scores.
The vulnerability can lead to unauthorized modifications of your package.json file, potentially exposing your application to security risks and malicious software.
You should immediately update or uninstall the Uyeups-Devapp package to mitigate the risks associated with this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just the package-lock.json file. You can also check your application against known vulnerabilities using the Vulert playground.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
