Malicious Code Injection in cheerful_impala_blush-86: A Threat to npm Packages
Summary
MAL-2025-100364: Malicious code in cheerful_impala_blush-86 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
cheerful_impala_blush-86 is an npm package that has been identified as part of a malicious campaign targeting the npm ecosystem. This package is associated with the tea.xyz token reward initiative, which aims to inflate developer reputation scores through the automatic generation and publication of derivative packages. The package's functionality is compromised by malicious scripts that alter its metadata and continuously republish variants, leading to pollution of the npm registry.
Vulnerability Detail
The vulnerability in cheerful_impala_blush-86 originates from its association with the tea.xyz token reward campaign. Malicious scripts embedded within the package modify the package.json file to remove private flags, alter version numbers, and generate random package names. This behavior not only compromises the integrity of the package but also poses a risk to developers who may unknowingly use these malicious variants, potentially leading to security breaches and loss of trust in the npm ecosystem.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall cheerful_impala_blush-86If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can avoid using cheerful_impala_blush-86 and any other packages associated with the tea.xyz token reward campaign. Regularly audit your project's dependencies to ensure no malicious packages are included.
Conclusion
The cheerful_impala_blush-86 package is compromised by malicious code that alters its metadata and repopulates the npm registry with harmful variants. It is crucial for developers to remove this package and monitor their dependencies for vulnerabilities to maintain the integrity and security of their projects.
See every vulnerability recorded for cheerful_impala_blush-86 →
FAQ
cheerful_impala_blush-86 is an npm package that has been identified as part of a malicious campaign aimed at inflating developer reputation scores.
The vulnerability can lead to the inclusion of malicious code in your project, compromising its integrity and security.
You should remove the cheerful_impala_blush-86 package from your project and monitor for any updates or patches.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software using just package-lock.json.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
