Malicious Code Injection in isolated_takin-excellentdev Package
Summary
MAL-2025-104437: Malicious code in isolated_takin-excellentdev (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The isolated_takin-excellentdev package is part of the npm ecosystem and is associated with the tea.xyz token reward campaign. This package is designed to facilitate token rewards through various automated scripts. However, it has been identified as containing malicious code that compromises its integrity and the security of applications that depend on it.
Vulnerability Detail
The vulnerability stems from malicious code embedded within the isolated_takin-excellentdev package. This code is designed to modify the package.json file by removing private flags, altering version numbers, and generating random package names. The primary goal is to inflate developer reputation scores for token rewards by flooding the npm registry with derivative packages. This can lead to significant security risks, including the potential for unauthorized access and manipulation of dependent applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall isolated_takin-excellentdevIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As an immediate workaround, consider removing the isolated_takin-excellentdev package from your project if it is not essential. You can do this by executing the command: npm uninstall isolated_takin-excellentdev. Additionally, monitor your package-lock.json file for any unexpected changes.
Conclusion
The isolated_takin-excellentdev package contains malicious code that poses a significant risk to applications using it. It is essential to update or remove the package to mitigate these risks. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for isolated_takin-excellentdev →
FAQ
It is an npm package associated with the tea.xyz token reward campaign, designed to facilitate automated token rewards.
The malicious code can alter your package.json file, potentially leading to unauthorized access and manipulation of your application.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
If an immediate update is not possible, consider removing the package and monitoring your application for any unusual behavior.
Detailed information can be found in the vulnerability report from Amazon Inspector and on platforms like Vulert.
