Malicious Code Injection in legitimate_egret-apptea Package
Summary
MAL-2025-105064: Malicious code in legitimate_egret-apptea (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The legitimate_egret-apptea package is part of the npm ecosystem and is associated with the tea.xyz token reward campaign. This package is designed to facilitate various functionalities within the npm environment but has been compromised. It is known for its ability to generate and publish derivative packages, which can inflate developer reputation scores for token rewards. However, this functionality has been exploited, leading to significant vulnerabilities.
Vulnerability Detail
The vulnerability stems from malicious code embedded within the legitimate_egret-apptea package. This code modifies the package.json file by removing private flags, altering version numbers, and generating random package names. The malicious payload continuously republishes these variants, polluting the npm registry and potentially compromising other packages. This behavior can lead to reputational damage for developers and security risks for applications relying on this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall legitimate_egret-appteaIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can remove the legitimate_egret-apptea package from your project by executing: npm uninstall legitimate_egret-apptea. This will prevent the execution of the malicious code until a secure version is available.
Conclusion
The legitimate_egret-apptea package has been compromised with malicious code that alters its functionality and can lead to significant security risks. It is crucial for developers to update or remove this package to safeguard their applications. Utilizing tools like Vulert can aid in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for legitimate_egret-apptea →
FAQ
The malicious code can lead to the pollution of the npm registry and may compromise the integrity of other packages, affecting the security of applications that depend on them.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By simply using your package-lock.json file, you can check for vulnerabilities without any installation. Visit Vulert Scanner to use the Vulert playground.
Regularly updating packages and using tools like Vulert to monitor for vulnerabilities can help prevent similar issues in the future.
If immediate updates are not possible, consider removing the package temporarily until a secure version is available.
The vulnerability was identified by Amazon Inspector, which specializes in detecting security issues in open-source packages.
