Malicious Code Injection in joan-teadev Package: A Threat to npm Ecosystem
Summary
MAL-2025-104562: Malicious code in joan-teadev (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The joan-teadev package is part of the npm ecosystem, which is widely used for JavaScript package management. This package, like many others, is intended to facilitate development by providing reusable code components. However, it has been identified as part of a malicious campaign that exploits npm's publishing capabilities, leading to potential security risks for developers and their applications.
Vulnerability Detail
The vulnerability in the joan-teadev package stems from its association with the tea.xyz token reward campaign, which has been flooding the npm registry with malicious packages. These packages contain scripts designed to automatically generate and publish derivative packages with randomized names, effectively polluting the npm registry. The malicious payload modifies the package.json file to remove private flags, alters version numbers, and continuously republishes variants, which can lead to reputation inflation for malicious actors and compromise the integrity of the npm ecosystem.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall joan-teadevIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the joan-teadev package and replace it with a trusted alternative. Ensure that any packages you use are from reputable sources and have been vetted for security.
Conclusion
The joan-teadev package poses a significant risk due to its malicious code injection capabilities. Developers should take immediate action to remove this package and monitor their projects for vulnerabilities. Utilizing tools like Vulert can help maintain the security of your applications in the ever-evolving landscape of open-source software.
See every vulnerability recorded for joan-teadev →
FAQ
The joan-teadev package is an npm package that has been identified as part of a malicious campaign to exploit the npm registry.
This vulnerability can lead to the injection of malicious code into your application, potentially compromising its security and integrity.
You should uninstall the joan-teadev package immediately using the command npm uninstall joan-teadev.
You can use tools like Vulert, which monitors your package-lock.json file to alert you in real-time for open-source vulnerabilities.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
