Malicious Code Injection in wibowo-jamblang59-breki: A Threat to npm Packages
Summary
MAL-2025-76240: Malicious code in wibowo-jamblang59-breki (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package wibowo-jamblang59-breki is part of the npm ecosystem, which is widely used for JavaScript package management. This package is associated with the tea.xyz token reward campaign that has been known to flood the npm registry with malicious packages. Its primary function is to serve as a tool for developers, but it has been compromised to include harmful scripts that can affect the integrity of the npm registry.
Vulnerability Detail
The vulnerability in wibowo-jamblang59-breki stems from its malicious payload that modifies the package.json file by removing private flags, altering version numbers, and generating random package names. This behavior is designed to inflate developer reputation scores through the automatic generation and republishing of derivative packages. The origin of this issue is linked to the tea.xyz token reward campaign, which has exploited npm's package management system to publish harmful scripts that pollute the registry and can lead to security risks for developers and users alike.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall wibowo-jamblang59-brekiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the affected package and check your project for any dependencies that may rely on it. If you find any, consider replacing them with alternative packages that do not have known vulnerabilities.
Conclusion
The wibowo-jamblang59-breki package has been identified as a malicious entity within the npm ecosystem, posing significant risks to developers and their applications. It is crucial to remove this package and monitor your dependencies for any vulnerabilities. Utilizing tools like Vulert can aid in maintaining the security of your projects.
See every vulnerability recorded for wibowo-jamblang59-breki →
FAQ
The impact includes potential exposure to malicious scripts that can compromise your project's integrity and security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
You should uninstall the package immediately and check for any dependencies that may be affected.
Yes, consider using other reputable packages that provide similar functionality without the associated risks.
Vulert uses your package-lock.json file to monitor for vulnerabilities and provides real-time alerts, helping you maintain a secure codebase.
