Malicious Code Injection in verify-ain-aiusamai Package
Summary
MAL-2025-170288: Malicious code in verify-ain-aiusamai (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The verify-ain-aiusamai package is part of the npm ecosystem, primarily used for various JavaScript applications. It was identified as part of a token reward campaign that aimed to inflate developer reputation scores. This package is particularly vulnerable due to its design, which allows for the automatic generation and publication of derivative packages, leading to potential security risks.
Vulnerability Detail
The vulnerability originates from the malicious intent behind the package, which modifies the package.json file to remove private flags and alters version numbers. It generates random package names and continuously republishes variants, polluting the npm registry. This behavior can lead to unauthorized access, data leakage, and compromise of the integrity of the npm ecosystem.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall verify-ain-aiusamaiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the verify-ain-aiusamai package and look for alternative packages that provide similar functionality without the associated risks. Additionally, you can implement strict package auditing in your development process.
Conclusion
The verify-ain-aiusamai package poses significant risks due to its malicious code designed to manipulate package metadata and publish unauthorized variants. It is crucial to remove this package and stay vigilant about the security of your dependencies.
See every vulnerability recorded for verify-ain-aiusamai →
FAQ
It is an npm package that was part of a malicious campaign to inflate developer reputation scores through automated publishing.
The vulnerability can lead to unauthorized modifications in your project's dependencies, potentially compromising security and functionality.
You should remove the verify-ain-aiusamai package immediately and monitor your project for any unusual behavior.
Yes, tools like Vulert can monitor your package-lock.json file to alert you in real-time for open-source vulnerabilities.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without any signup.
