Malicious Code Injection in Complicated Rhinoceros Appteadev Package
Summary
MAL-2025-100789: Malicious code in complicated_rhinoceros-appteadev (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The 'complicated_rhinoceros-appteadev' package is part of the npm ecosystem, often utilized in various JavaScript applications. It is associated with the tea.xyz token reward campaign, which has been known to flood npm with packages that include malicious scripts. These scripts are designed to manipulate package metadata and inflate developer reputation scores, posing significant risks to users and the integrity of the npm registry.
Vulnerability Detail
This vulnerability originates from malicious code embedded in the 'complicated_rhinoceros-appteadev' package. The code modifies the package.json file to remove private flags, alters version numbers, and generates random package names, which are then republished to the npm registry. This behavior can lead to pollution of the npm registry, potential security risks for applications relying on this package, and a compromised developer reputation system.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall complicated_rhinoceros-appteadevIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the 'complicated_rhinoceros-appteadev' package from your project by executing 'npm uninstall complicated_rhinoceros-appteadev'. This will prevent any malicious code from executing until a secure version is available.
Conclusion
The 'complicated_rhinoceros-appteadev' package contains malicious code that poses significant risks to applications using it. It is crucial to take immediate action by updating or removing the package to safeguard your project and maintain the integrity of the npm ecosystem.
See every vulnerability recorded for complicated_rhinoceros-appteadev →
FAQ
The impact includes potential security risks, such as unauthorized access to sensitive data, and the pollution of the npm registry with malicious packages.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you cannot update the package, consider removing it from your project as a temporary measure until a secure version is available.
The malicious code modifies the package.json file to remove private flags and changes version numbers, allowing the package to be republished with random names, which can mislead users.
To prevent future vulnerabilities, regularly audit your dependencies, use tools like Vulert for monitoring, and only install packages from trusted sources.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
