Malicious Code Injection in chilly_lion-toolteadev Package
Summary
MAL-2025-100386: Malicious code in chilly_lion-toolteadev (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The chilly_lion-toolteadev package is part of the npm ecosystem, primarily used for development tools. However, it has been identified as part of a malicious campaign that aims to inflate developer reputation scores through the generation of derivative packages. This package is particularly vulnerable due to its association with the tea.xyz token reward scheme, which exploits npm's publishing mechanisms.
Vulnerability Detail
The vulnerability stems from the presence of malicious code within the chilly_lion-toolteadev package. This code is designed to modify the package.json file by removing private flags, altering version numbers, and generating random package names. The malicious payload continuously republishes these variants to pollute the npm registry, posing risks such as reputation damage for developers and potential security threats for applications relying on these packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall chilly_lion-toolteadevIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the installation of the affected package by using the npm shrinkwrap feature or by specifying exact versions of dependencies in your package.json file to avoid pulling in the malicious package.
Conclusion
The chilly_lion-toolteadev package has been identified as containing malicious code that compromises the integrity of the npm registry. It is crucial for developers to remove this package and monitor their applications for any potential vulnerabilities. Utilizing tools like Vulert can help in maintaining the security of your software.
See every vulnerability recorded for chilly_lion-toolteadev →
FAQ
It is an npm package used for development tools, but it has been compromised with malicious code.
The malicious code can alter your package.json, inflate developer reputation scores, and potentially introduce security vulnerabilities.
You should uninstall the package immediately and monitor your application for any unusual behavior.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. You can check your application using the Vulert playground at Vulert Scanner without any signup.
If your project does not rely on the functionalities provided by this package, removing it should not affect your project. However, ensure to test your application after removal.
