Malicious Code Injection in cruel_dormouse-toolteadev Package
Summary
MAL-2025-101120: Malicious code in cruel_dormouse-toolteadev (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cruel_dormouse-toolteadev package is part of the npm ecosystem, often utilized in various JavaScript projects. It is designed to enhance development workflows but has been compromised by malicious actors. This package is associated with the tea.xyz token reward campaign, which has been known to flood the npm registry with derivative packages that inflate developer reputation scores. The vulnerability arises from the package's ability to modify critical files, making it susceptible to exploitation.
Vulnerability Detail
The vulnerability in the cruel_dormouse-toolteadev package stems from its inclusion in a malicious campaign that generates and publishes derivative packages with randomized names. This malicious code modifies the package.json file to remove private flags, alters version numbers, and continuously republishes variants to pollute the npm registry. The origin of this vulnerability is linked to the tea.xyz token reward campaign, which aims to manipulate npm's reputation system. The ramifications include potential security risks for developers using this package, as it can lead to unauthorized access and manipulation of their projects.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall cruel_dormouse-toolteadevIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the cruel_dormouse-toolteadev package from your project and replace it with a trusted alternative. To uninstall the package, run: 'npm uninstall cruel_dormouse-toolteadev'. Additionally, consider using tools like Vulert to monitor your project for vulnerabilities. You can check if your application is affected by this vulnerability using the Vulert playground at https://vulert.com/scanner without any signup.
Conclusion
The cruel_dormouse-toolteadev package has been identified as containing malicious code that poses significant risks to developers. It is crucial to take immediate action by updating or removing the package to safeguard your projects. Utilizing tools like Vulert can help monitor for vulnerabilities effectively.
See every vulnerability recorded for cruel_dormouse-toolteadev →
FAQ
It is an npm package used in JavaScript projects, but it has been compromised by malicious code.
The malicious code modifies critical files and can lead to unauthorized access and manipulation of your project.
You can use the Vulert playground at Vulert Scanner to check for vulnerabilities without signing up.
You should update the package to the latest version or uninstall it and replace it with a trusted alternative.
Vulert is a monitoring tool that uses package-lock.json to alert in real-time for open-source vulnerabilities in your software.
