Malicious Code Injection in vicarious_rooster-silentdev Package
Summary
MAL-2025-110459: Malicious code in vicarious_rooster-silentdev (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vicarious_rooster-silentdev package is part of the npm ecosystem, typically used for various development tasks. However, it has been identified as part of a malicious campaign that exploits npm's package management system. This package, like others in the campaign, is designed to inflate developer reputation scores through automated publishing of derivative packages with randomized names.
Vulnerability Detail
The vulnerability in the vicarious_rooster-silentdev package stems from its involvement in a malicious campaign that modifies the package.json file to remove private flags, alters version numbers, and generates random package names. This behavior leads to the continuous republishing of variants, polluting the npm registry and potentially compromising the integrity of other packages. The malicious code is part of a broader effort to exploit npm for token rewards, making it a significant risk for developers relying on this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall vicarious_rooster-silentdevIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can temporarily avoid using the vicarious_rooster-silentdev package in your project. If you need similar functionality, consider using alternative packages that are verified and do not have known vulnerabilities.
Conclusion
The vicarious_rooster-silentdev package poses a significant risk due to its malicious behavior aimed at manipulating the npm ecosystem. It is crucial for developers to remove this package and monitor their projects for vulnerabilities to maintain security and integrity.
See every vulnerability recorded for vicarious_rooster-silentdev →
FAQ
It is an npm package that has been identified as part of a malicious campaign aimed at inflating developer reputation scores through automated publishing.
The vulnerability can lead to the pollution of the npm registry and may compromise the integrity of your project by introducing unwanted or malicious packages.
You should remove the vicarious_rooster-silentdev package from your project immediately to prevent any potential risks.
Currently, there are no patches available for the vicarious_rooster-silentdev package. The best course of action is to uninstall it.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json file. You can check your application for vulnerabilities using the Vulert playground without any signup.
