MalwarePublished 10 Nov 2025

vina-kolak31-riris (npm) · Malicious Code

Affects vina-kolak31-ririsSource GCVE Database

Malicious package : remove vina-kolak31-riris and rotate any secrets on hosts that installed it.

Data as of 4 Nov 2026, 18:59 UTC

Classification

Malicious package

Published to npm · OSV MAL-2025-50672

What to do

Remove vina-kolak31-riris from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmvina-kolak31-riris	Affected–	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package vina-kolak31-riris was identified as containing malicious code linked to a large-scale spam campaign associated with the tea.xyz token reward system. This campaign involved flooding the npm registry with over 15,000 spam packages in 2024. The malicious code includes autopublish scripts that automatically generate and publish derivative packages with randomized Indonesian-themed names. These scripts modify package metadata to remove privacy flags and increment version numbers, enabling continuous republishing to inflate developer reputation scores and pollute the npm ecosystem.

Impact

This malicious package contributes to ecosystem pollution by flooding the npm registry with spam packages, which can degrade trust in the registry and complicate package management. It manipulates package metadata to bypass privacy controls and repeatedly publishes variants, potentially misleading users and automated systems that rely on reputation metrics. While no direct exploitation or compromise of user systems is documented, the campaign undermines the integrity of the npm ecosystem and token reward mechanisms.

Defensive guidance

Users and maintainers should avoid installing the vina-kolak31-riris package and related variants. Registry maintainers and security teams should monitor and remove such spam packages to preserve ecosystem integrity. Developers should verify package provenance and avoid packages involved in known spam campaigns.

Summary

The vina-kolak31-riris npm package is part of a widespread malicious campaign targeting the npm registry, leveraging autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) to automatically create and publish numerous derivative packages with randomized names. The payload manipulates package.json by removing private flags and altering version numbers to facilitate repeated publication. This activity aims to exploit the tea.xyz token reward system by artificially inflating developer reputation scores and causing registry pollution. No specific CVSS score or known exploits in the wild are reported.

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 4 Nov 2026, 18:59 UTC

Technical details

Community reviews