Malicious Code Injection in elaborate_pelican-appteadev Package
Summary
MAL-2025-101983: Malicious code in elaborate_pelican-appteadev (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The elaborate_pelican-appteadev package is part of the npm ecosystem, typically used for web development and application building. This package has been identified as part of a malicious campaign that exploits npm's package management system. It is designed to automatically generate and publish derivative packages, which can lead to reputation inflation for developers involved in the tea.xyz token reward campaign.
Vulnerability Detail
The vulnerability originates from the package being part of a malicious campaign that floods the npm registry with derivative packages. The malicious code modifies the package.json file to remove private flags, alters version numbers, and generates random package names, which can lead to the pollution of the npm registry. This can have serious ramifications, including the potential for developers to unknowingly use compromised packages, leading to security risks in their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall elaborate_pelican-appteadevIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the elaborate_pelican-appteadev package from your project by running: npm uninstall elaborate_pelican-appteadev. This will prevent any malicious code from executing until a secure version is available.
Conclusion
The elaborate_pelican-appteadev package has been compromised as part of a malicious campaign that affects the npm ecosystem. It is essential for developers to take immediate action by updating or removing the package to safeguard their applications from potential threats. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for elaborate_pelican-appteadev →
FAQ
It is an npm package used in web development, but it has been identified as part of a malicious campaign.
If your application uses this package, it may be at risk of incorporating malicious code that can compromise security.
You should update the package to a patched version or remove it from your project until a secure version is available.
You can use tools like Vulert, which monitors your package-lock.json for vulnerabilities in real-time without requiring code access.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without signing up.
