Malicious Code Vulnerability in female_ladybug-appteadev Package
Summary
MAL-2025-102671: Malicious code in female_ladybug-appteadev (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The female_ladybug-appteadev package is part of the npm ecosystem, which is widely used for JavaScript development. This package is associated with the tea.xyz token reward campaign, which has been known to flood the npm registry with various packages. The functionality of this package is compromised due to the presence of malicious code that alters its behavior and affects the integrity of the npm registry.
Vulnerability Detail
The vulnerability originates from malicious code embedded within the female_ladybug-appteadev package. This code is designed to modify the package.json file by removing private flags, changing version numbers, and generating random package names. The malicious payload continuously republishes these variants, leading to pollution of the npm registry and potentially damaging the reputation of developers using this package. The presence of autopublish scripts indicates an automated approach to inflate developer reputation scores for token rewards, which poses a significant risk to the integrity of the npm ecosystem.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall female_ladybug-appteadevIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the affected package from your project by executing the following command: npm uninstall female_ladybug-appteadev. This will prevent the malicious code from executing and protect your project from potential harm.
Conclusion
The female_ladybug-appteadev package contains a serious vulnerability due to malicious code that alters its functionality and can compromise the integrity of the npm registry. It is crucial to take immediate action by uninstalling the package and monitoring your project for any unusual behavior. Utilizing tools like Vulert can help maintain the security of your open-source projects.
See every vulnerability recorded for female_ladybug-appteadev →
FAQ
The female_ladybug-appteadev package is an npm package associated with the tea.xyz token reward campaign, which has been identified to contain malicious code.
The malicious code modifies your package.json file, removes private flags, and continuously republishes variants, which can lead to pollution of the npm registry and damage your project's integrity.
You should uninstall the female_ladybug-appteadev package immediately and monitor your project for any unusual behavior.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just your package-lock.json file. You can also check your application for vulnerabilities using the Vulert playground without any signup.
Regularly update your dependencies, monitor for vulnerabilities using tools like Vulert, and review the packages you use for any known issues.
