Malicious Code Injection in wide_caterpillar_0xrequest Package
Summary
MAL-2025-110901: Malicious code in wide_caterpillar_0xrequest (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The wide_caterpillar_0xrequest package is part of a series of npm packages that emerged during the tea.xyz token reward campaign. These packages are designed to inflate developer reputation scores by automatically generating and publishing derivative packages with randomized names. The malicious nature of this package lies in its ability to modify the package.json file, impacting its integrity and security.
Vulnerability Detail
The vulnerability in the wide_caterpillar_0xrequest package originates from its association with the tea.xyz token reward campaign, which is known for flooding the npm registry with malicious packages. The package contains scripts that remove private flags from package.json, alter version numbers, and generate random package names. This behavior can lead to the pollution of the npm registry and compromise the security of applications relying on this package, potentially allowing for further exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall wide_caterpillar_0xrequestIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the execution of the malicious scripts by ensuring that your npm configuration does not allow the execution of scripts from packages. You can do this by setting the following configuration: npm config set ignore-scripts true.
Conclusion
The wide_caterpillar_0xrequest package poses a significant security risk due to its malicious code that alters package.json files and floods the npm registry. It is crucial to remove this package and monitor your dependencies for any vulnerabilities to maintain the security of your applications.
See every vulnerability recorded for wide_caterpillar_0xrequest →
FAQ
It is an npm package that is part of a malicious campaign aimed at inflating developer reputation scores by flooding the npm registry with derivative packages.
The vulnerability can compromise the integrity of your application's dependencies, potentially leading to security risks and exploitation.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
You should uninstall the package immediately and check for any dependencies that may rely on it. Update those dependencies as necessary.
Yes, tools like Vulert can help monitor your project for vulnerabilities in real-time using just the package-lock.json file.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
