Malicious Code Injection in grim_egret-appteadev: A Threat to npm Users
Summary
MAL-2025-103381: Malicious code in grim_egret-appteadev (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
grim_egret-appteadev is a package within the npm ecosystem, primarily used for various development tasks. However, it has been identified as part of a malicious campaign that exploits npm's package management system. This package is linked to the tea.xyz token reward scheme, which aims to inflate developer reputation scores through the automatic generation and publication of derivative packages.
Vulnerability Detail
The vulnerability in grim_egret-appteadev stems from its malicious payload that modifies the package.json file. This includes removing private flags, altering version numbers, and generating random package names, which leads to the pollution of the npm registry. The malicious code is designed to continuously republish these variants, thereby compromising the integrity of the npm ecosystem and potentially affecting developers who rely on these packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall grim_egret-appteadevIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, the best workaround is to avoid using grim_egret-appteadev altogether. If you have already installed it, ensure to remove it immediately and monitor your project for any dependencies that may have been affected.
Conclusion
The grim_egret-appteadev package poses a significant risk to npm users due to its malicious code that alters package configurations and pollutes the npm registry. Immediate action is required to uninstall this package and safeguard your projects from potential threats.
See every vulnerability recorded for grim_egret-appteadev →
FAQ
grim_egret-appteadev is an npm package that has been identified as part of a malicious campaign aimed at inflating developer reputation scores.
The vulnerability can lead to the pollution of the npm registry and may compromise the integrity of your project by introducing unwanted or malicious packages.
You should uninstall grim_egret-appteadev immediately and check for any other affected packages in your project.
Currently, there is no specific patch for grim_egret-appteadev. The recommended action is to uninstall the package.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities by analyzing your package-lock.json. You can also check your application for vulnerabilities using the Vulert playground without any signup.
