Malicious Code Injection in wulan-30 Package: A Threat to npm Ecosystem
Summary
MAL-2025-170555: Malicious code in wulan-30 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The wulan-30 package is part of the npm ecosystem, which is widely used for JavaScript package management. This package, like many others, is designed to facilitate the development and deployment of applications by providing reusable code components. However, it has been identified as part of a malicious campaign that aims to exploit npm's publishing capabilities, leading to potential security risks for developers and users alike.
Vulnerability Detail
The vulnerability in the wulan-30 package originates from its association with the tea.xyz token reward campaign. This campaign has led to the proliferation of malicious packages that contain scripts designed to automatically publish derivative packages with altered metadata. The malicious payload modifies the package.json file to remove private flags, changes version numbers, and generates random package names, which can lead to pollution of the npm registry and compromise the integrity of the ecosystem. Developers using this package may unknowingly contribute to the spread of malicious code, putting their applications and users at risk.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall wulan-30If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the wulan-30 package and look for alternative packages that provide similar functionality without the associated risks. Additionally, ensure that your project's dependencies are regularly audited for vulnerabilities using tools like npm audit.
Conclusion
The wulan-30 package poses a significant security risk due to its malicious code injection capabilities. It is essential for developers to be vigilant and remove any affected packages from their projects. Regular audits and the use of monitoring tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for wulan-30 →
FAQ
The wulan-30 package is a JavaScript package available on npm, which is part of a malicious campaign aimed at exploiting the npm ecosystem.
The vulnerability can lead to the injection of malicious code into your application, potentially compromising its security and integrity.
You should uninstall the wulan-30 package immediately and check your project for any other potentially malicious dependencies.
You can use tools like npm audit to check for vulnerabilities in your project's dependencies. Additionally, Vulert can monitor your package-lock.json for real-time alerts on open-source vulnerabilities.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
