Malicious Code Injection in wati-rangi58-breki Package
Summary
MAL-2025-76145: Malicious code in wati-rangi58-breki (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The wati-rangi58-breki package is part of the npm ecosystem, which is widely used for JavaScript package management. This package has been identified as part of a malicious campaign aimed at exploiting npm's publishing capabilities. It is designed to inflate developer reputation scores through the automatic generation and publication of derivative packages with randomized names, which can lead to pollution of the npm registry.
Vulnerability Detail
The vulnerability in the wati-rangi58-breki package stems from its malicious payload that modifies the package.json file. It removes private flags, alters version numbers, and generates random package names, primarily themed around Indonesian culture. This behavior is part of a broader scheme to manipulate the npm registry, potentially leading to security risks for developers who unknowingly use these compromised packages. The origin of this vulnerability is linked to the tea.xyz token reward campaign, which has flooded the npm ecosystem with similar malicious packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall wati-rangi58-brekiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can avoid using the wati-rangi58-breki package altogether. If it is already included in your project, remove it by running: npm uninstall wati-rangi58-breki. Additionally, consider using tools like Vulert to monitor your dependencies for vulnerabilities. You can check if your application is affected by this vulnerability using the Vulert playground at https://vulert.com/scanner without any signup.
Conclusion
The wati-rangi58-breki package poses a significant security risk due to its malicious code that alters package metadata and floods the npm registry with compromised packages. It is crucial for developers to remove this package and monitor their dependencies for vulnerabilities using tools like Vulert.
See every vulnerability recorded for wati-rangi58-breki →
FAQ
The wati-rangi58-breki package is an npm package that has been identified as part of a malicious campaign aimed at manipulating the npm registry.
The vulnerability can lead to the introduction of malicious code into your project, potentially compromising security and functionality.
You should uninstall the wati-rangi58-breki package immediately and monitor your project for any unusual behavior.
Yes, tools like Vulert can help monitor your dependencies for vulnerabilities in real-time using just your package-lock.json file.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
