Malicious Code Vulnerability in yrinth: Exploitation of npm Registry
Summary
MAL-2025-71748: Malicious code in yrinth (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
yrinth is an npm package that has been implicated in a malicious campaign targeting the npm registry. It is part of a broader initiative that aims to manipulate developer reputation scores through the creation and publication of derivative packages. The package's functionality has been compromised, leading to significant security concerns.
Vulnerability Detail
The vulnerability in yrinth stems from its association with a malicious campaign that modifies the package.json file to remove private flags and alters version numbers. It generates random package names, primarily themed around Indonesian culture, and continuously republishes these variants to clutter the npm registry. This behavior not only affects the integrity of the npm ecosystem but also poses risks to developers who may unknowingly use these compromised packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall yrinthIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the yrinth package entirely. If it is already in your project, remove it by running: npm uninstall yrinth. This will help mitigate the risks associated with the malicious code.
Conclusion
The yrinth package has been identified as a vector for malicious code that compromises the integrity of the npm registry. Developers are advised to remove this package from their projects and to stay vigilant for updates or patches. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for yrinth →
FAQ
yrinth is an npm package that has been linked to a malicious campaign aimed at manipulating developer reputation scores through the publication of compromised packages.
The malicious code modifies your package.json file, removes private flags, and generates random package names, potentially leading to security vulnerabilities and cluttering the npm registry.
You should uninstall the yrinth package immediately using the command: npm uninstall yrinth to mitigate any potential risks.
As of now, there is no specific patched version available. It is recommended to remove the package until a secure version is released.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json. You can check your application for vulnerabilities using the Vulert playground at Vulert Scanner without any signup.
