Malicious Code Injection in zealous_impala_z3n Package - npm Vulnerability
Summary
MAL-2025-99020: Malicious code in zealous_impala_z3n (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The zealous_impala_z3n package is part of the npm ecosystem, often used in JavaScript projects for various functionalities. However, it has been identified as part of a malicious campaign that floods the npm registry with derivative packages aimed at inflating developer reputation scores. This package, like others in the campaign, contains scripts designed to manipulate package metadata and publish unauthorized versions.
Vulnerability Detail
The vulnerability originates from the zealous_impala_z3n package being part of a malicious token reward scheme. It includes scripts that modify the package.json file to remove private flags, alter version numbers, and generate random package names. This behavior leads to the pollution of the npm registry and can compromise the integrity of projects relying on this package. The malicious payload can also affect the reputation of developers and the overall trust in the npm ecosystem.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall zealous_impala_z3nIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can manually remove the zealous_impala_z3n package from your project by running the command: npm uninstall zealous_impala_z3n. Additionally, consider using alternative packages that do not have known vulnerabilities.
Conclusion
The zealous_impala_z3n package poses a significant risk due to its malicious code designed to manipulate npm registry data. It is essential for developers to be vigilant about the packages they use and to take immediate action to remove any identified vulnerabilities. Utilizing tools like Vulert can aid in maintaining the security of your projects.
See every vulnerability recorded for zealous_impala_z3n →
FAQ
The zealous_impala_z3n package is an npm package that has been identified as part of a malicious campaign to inflate developer reputation scores through the creation of derivative packages.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can help you identify affected packages.
Using the zealous_impala_z3n package can lead to the pollution of the npm registry, compromise project integrity, and negatively impact developer reputation.
To prevent similar vulnerabilities, regularly audit your dependencies, use tools like Vulert for real-time monitoring, and stay informed about security advisories related to the packages you use.
If you have already used the zealous_impala_z3n package, it is crucial to remove it immediately and replace it with a secure alternative. Additionally, review your project for any potential impacts caused by the malicious code.
