Malicious Code Vulnerability in conceptual_mule-apptea Package
Summary
MAL-2025-100807: Malicious code in conceptual_mule-apptea (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The conceptual_mule-apptea package is part of the tea.xyz token reward campaign, which has been associated with a series of malicious npm packages. These packages are designed to inflate developer reputation scores through the automatic generation and publication of derivative packages with randomized names. The vulnerability stems from the presence of autopublish scripts that manipulate package metadata, potentially leading to significant pollution of the npm registry.
Vulnerability Detail
This vulnerability originates from a malicious payload embedded in the conceptual_mule-apptea package. The payload modifies the package.json file by removing private flags, altering version numbers, and generating random package names. This behavior not only compromises the integrity of the npm registry but also poses risks to developers who may unknowingly use these polluted packages, leading to potential security breaches and loss of trust in the ecosystem.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall conceptual_mule-appteaIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the conceptual_mule-apptea package and any packages that depend on it. Additionally, consider using a package-lock.json file to lock your dependencies to known safe versions.
Conclusion
The conceptual_mule-apptea package contains a serious vulnerability that can compromise the integrity of the npm registry and the security of projects that use it. Immediate action is required to remove the package and monitor for any potential impacts. Utilizing tools like Vulert can help in maintaining the security of your open-source dependencies.
See every vulnerability recorded for conceptual_mule-apptea →
FAQ
It is an npm package associated with the tea.xyz token reward campaign, which has been linked to malicious activities.
The vulnerability can lead to the pollution of the npm registry and may compromise the security of your project by introducing malicious code.
You should uninstall the package immediately and check for any dependencies that may be affected.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json file.
You can use the Vulert playground at Vulert Scanner to check your application for vulnerabilities without needing to sign up.
