Malicious Code Injection in clinical_trout-apptea: A Threat to npm Packages
Summary
MAL-2025-100602: Malicious code in clinical_trout-apptea (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
clinical_trout-apptea is an npm package that is part of the tea.xyz token reward campaign. This package is designed to facilitate token rewards for developers by allowing them to publish derivative packages. However, it has been compromised, leading to significant security concerns. The package's functionality is intended for legitimate use, but its vulnerability exposes users to malicious activities that can affect the integrity of the npm registry.
Vulnerability Detail
The vulnerability in clinical_trout-apptea originates from its association with a malicious campaign that floods the npm registry with derivative packages. This package contains scripts that automatically modify the package.json file to remove private flags, alter version numbers, and generate random package names. The malicious payload continuously republishes these variants, leading to pollution of the npm registry and potential exploitation of developers' reputations.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall clinical_trout-appteaIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the clinical_trout-apptea package from your project until a secure version is confirmed. You can do this by executing 'npm uninstall clinical_trout-apptea'.
Conclusion
The clinical_trout-apptea package has been identified as containing malicious code that poses a significant risk to npm users. It is crucial to take immediate action by updating or removing the package to safeguard your projects. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for clinical_trout-apptea →
FAQ
clinical_trout-apptea is an npm package associated with the tea.xyz token reward campaign, designed to facilitate the publication of derivative packages.
The vulnerability can lead to the modification of your package.json file, potentially compromising your project's integrity and reputation on the npm registry.
If you have installed clinical_trout-apptea, it is recommended to uninstall it immediately and monitor for any updates or patches.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
Regularly update your packages, monitor for vulnerabilities using tools like Vulert, and review package dependencies before installation.
