Malicious Code Injection in Inevitable Kiwi Appteadev Package
Summary
MAL-2025-104180: Malicious code in inevitable_kiwi-appteadev (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'inevitable_kiwi-appteadev' package is part of the npm ecosystem, often utilized in various JavaScript applications. It is associated with the tea.xyz token reward campaign, which has been known to flood the npm registry with packages that can inflate developer reputation scores. This package, like others in its category, is designed to generate and publish derivative packages with randomized names, which can lead to significant pollution of the npm registry.
Vulnerability Detail
The vulnerability in the 'inevitable_kiwi-appteadev' package stems from its malicious payload that modifies the package.json file. It removes private flags, alters version numbers, and generates random Indonesian-themed package names. This behavior not only compromises the integrity of the affected package but also contributes to the overall pollution of the npm registry, potentially affecting other developers and applications relying on legitimate packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall inevitable_kiwi-appteadevIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the 'inevitable_kiwi-appteadev' package from your project by executing: 'npm uninstall inevitable_kiwi-appteadev'. This will prevent any malicious code from executing while you seek a secure alternative.
Conclusion
The 'inevitable_kiwi-appteadev' package contains a significant vulnerability that can lead to malicious code execution and npm registry pollution. It is crucial for developers to monitor their dependencies, update to secure versions, and utilize tools like Vulert for real-time vulnerability alerts.
See every vulnerability recorded for inevitable_kiwi-appteadev →
FAQ
The vulnerability involves malicious code that modifies package.json, removes private flags, and generates random package names, leading to npm registry pollution.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
The consequences include compromised package integrity, potential security risks for applications using the package, and pollution of the npm registry affecting other developers.
It is essential to check the npm registry for any patched versions of the 'inevitable_kiwi-appteadev' package and update accordingly.
If an immediate update is not possible, consider uninstalling the package to mitigate risks until a secure version is available.
