Malicious Code Injection in vera-ragi89-ruro Package - npm Vulnerability
Summary
MAL-2025-110408: Malicious code in vera-ragi89-ruro (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vera-ragi89-ruro package is part of the npm ecosystem, which is widely used for JavaScript package management. This package is suspected to be involved in a token reward campaign that has led to the proliferation of malicious packages. The primary functionality of this package is to serve as a tool for developers, but it has been compromised to serve malicious purposes, affecting the integrity of the npm registry.
Vulnerability Detail
The vulnerability originates from the malicious code embedded within the vera-ragi89-ruro package. This code is designed to modify the package.json file by removing private flags, altering version numbers, and generating random package names. The malicious payload continuously republishes these variants, leading to pollution of the npm registry and potential exploitation of developers' reputations. The ramifications include unauthorized access to sensitive information and the risk of further malicious activities stemming from the compromised packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall vera-ragi89-ruroIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the vera-ragi89-ruro package and monitor your application for any dependencies that may have been affected by this vulnerability. You can also use the following command to audit your npm packages for vulnerabilities: 'npm audit'.
Conclusion
The vera-ragi89-ruro package has been identified as a malicious entity within the npm ecosystem, posing significant risks to developers and their projects. It is crucial to take immediate action to remove this package and monitor your applications for any potential vulnerabilities. Utilizing tools like Vulert can aid in maintaining the security of your software.
See every vulnerability recorded for vera-ragi89-ruro →
FAQ
The vera-ragi89-ruro package is an npm package that has been identified as malicious, designed to manipulate package metadata and publish unauthorized variants.
You can use the Vulert platform to monitor your package-lock.json file for vulnerabilities. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The risks include unauthorized modifications to your project, potential exposure of sensitive data, and damage to your reputation as a developer due to the proliferation of malicious packages.
Regularly audit your dependencies, use tools like Vulert for real-time monitoring, and stay updated on security advisories related to the packages you use.
Immediately uninstall the package using 'npm uninstall vera-ragi89-ruro' and check your project for any unauthorized changes or vulnerabilities.
