Malicious Code Injection in elwood-teadev Package
Summary
MAL-2025-102050: Malicious code in elwood-teadev (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The elwood-teadev package is part of the npm ecosystem, primarily used for development purposes. It is associated with the tea.xyz token reward campaign, which has been known to flood the npm registry with various packages. This package, like others in the campaign, is designed to manipulate npm's publishing system, potentially compromising the integrity of the npm registry and affecting developers who rely on it.
Vulnerability Detail
The vulnerability in the elwood-teadev package stems from its malicious code, which modifies the package.json file to remove private flags, alters version numbers, and generates random package names. This behavior is intended to inflate developer reputation scores for token rewards, leading to the continuous republishing of these variants, which pollutes the npm registry. The origin of this issue is linked to the tea.xyz token reward campaign, which employs autopublish scripts to automate the creation of derivative packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall elwood-teadevIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the elwood-teadev package from your project by executing the command: 'npm uninstall elwood-teadev'. This will prevent any malicious code from executing until a secure version is available.
Conclusion
The elwood-teadev package contains a significant vulnerability due to its malicious code, which alters package metadata and affects the npm registry. It is crucial for developers to take immediate action by updating or removing the package to safeguard their projects. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in real-time.
See every vulnerability recorded for elwood-teadev →
FAQ
elwood-teadev is an npm package associated with the tea.xyz token reward campaign, which aims to manipulate npm's publishing system.
The vulnerability can lead to the modification of your package.json file, potentially compromising your project's integrity and security.
You should immediately update the package to the latest version or uninstall it to mitigate the risk of malicious code execution.
You can use Vulert, which monitors your package-lock.json file for open-source vulnerabilities in real-time without requiring code access or installation.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
