Malicious Code Injection in vera-sate73-tititugel: A Threat to npm Ecosystem
Summary
MAL-2025-98475: Malicious code in vera-sate73-tititugel (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package vera-sate73-tititugel is part of the npm ecosystem and appears to be associated with a token reward campaign by tea.xyz. This package is designed to manipulate the npm registry by generating and publishing derivative packages with randomized names, which can inflate developer reputation scores. Its functionality is compromised due to the presence of malicious code that alters package metadata.
Vulnerability Detail
The vulnerability in vera-sate73-tititugel originates from its design to include autopublish scripts that modify the package.json file. This malicious payload removes private flags, alters version numbers, and generates random package names, leading to pollution of the npm registry. The ramifications include potential security risks for developers who unknowingly use these compromised packages, as well as damage to the integrity of the npm ecosystem.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall vera-sate73-tititugelIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the affected package and consider using alternative packages that provide similar functionality without the associated risks. Additionally, regularly audit your dependencies using tools like Vulert to monitor for vulnerabilities.
Conclusion
The discovery of malicious code in the vera-sate73-tititugel package highlights the importance of vigilance in the npm ecosystem. Developers should take immediate action to remove affected packages and utilize tools like Vulert to safeguard their projects against potential threats.
See every vulnerability recorded for vera-sate73-tititugel →
FAQ
vera-sate73-tititugel is an npm package that has been identified as malicious due to its involvement in a token reward campaign that manipulates the npm registry.
The vulnerability can lead to the introduction of malicious code into your project, potentially compromising its security and integrity.
If you have installed vera-sate73-tititugel, you should uninstall it immediately and check for any other affected packages in your project.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json file. You can also check your application against known vulnerabilities using the Vulert playground.
To prevent future vulnerabilities, regularly audit your dependencies, use trusted packages, and consider employing tools that monitor for vulnerabilities in real-time.
