Malicious Code Injection in vera-martabak39-ruro Package
Summary
MAL-2025-110401: Malicious code in vera-martabak39-ruro (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The vera-martabak39-ruro package is part of the npm ecosystem, often utilized for various JavaScript applications. It is known for its role in the tea.xyz token reward campaign, which has been associated with the proliferation of malicious packages designed to inflate developer reputation scores. This package, like many others in the campaign, has been compromised to include harmful scripts that manipulate package metadata.
Vulnerability Detail
The vulnerability stems from the inclusion of malicious code within the vera-martabak39-ruro package. This code is designed to automatically modify the package.json file by removing private flags, altering version numbers, and generating random package names. The malicious payload continuously republishes these variants to pollute the npm registry, potentially leading to security risks for developers who unknowingly use these compromised packages. The origin of this vulnerability is linked to the tea.xyz token reward campaign, which has flooded the npm registry with such malicious packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall vera-martabak39-ruroIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the vera-martabak39-ruro package altogether and look for alternative packages that provide similar functionality without the associated risks. Additionally, you can monitor your project for any unauthorized changes to package.json.
Conclusion
The vera-martabak39-ruro package has been identified as containing malicious code that poses significant risks to developers. It is crucial to remove this package from your projects and monitor for any unauthorized changes. Utilizing tools like Vulert can help in maintaining the security of your software by alerting you to open-source vulnerabilities.
See every vulnerability recorded for vera-martabak39-ruro →
FAQ
The vera-martabak39-ruro package is an npm package that has been compromised to include malicious code as part of a token reward campaign.
You can check your project's package-lock.json file for the presence of the vera-martabak39-ruro package. Additionally, you can use Vulert to monitor and alert for vulnerabilities in real-time.
Using compromised packages can lead to unauthorized modifications of your project, potential data breaches, and overall security vulnerabilities.
Regularly auditing your dependencies, using tools like Vulert, and staying informed about known vulnerabilities can help prevent such issues.
Immediately uninstall the package and review your project for any unauthorized changes. Consider using alternative packages and monitor your project for any further issues.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
