Malicious Code Injection in munir-teaars-sdaa: A Threat to npm Ecosystem
Summary
MAL-2025-160930: Malicious code in munir-teaars-sdaa (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'munir-teaars-sdaa' is part of the npm ecosystem and is associated with the tea.xyz token reward campaign. This package is designed to interact with the npm registry and is typically used for publishing JavaScript packages. However, it has been identified as containing malicious code that compromises the integrity of the npm ecosystem.
Vulnerability Detail
The vulnerability in 'munir-teaars-sdaa' originates from its malicious payload, which modifies the package.json file to remove private flags and alters version numbers. It generates random Indonesian-themed package names and continuously republishes variants to pollute the npm registry. This behavior not only inflates developer reputation scores for token rewards but also poses a significant risk of dependency confusion and potential exploitation by malicious actors.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall munir-teaars-sdaaIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can temporarily prevent the installation of this package by using npm's package-lock.json to lock your dependencies. Additionally, consider using the following command to audit your project for vulnerabilities: npm audit.
Conclusion
The 'munir-teaars-sdaa' package poses a significant risk due to its malicious code that alters package metadata and repopulates the npm registry with compromised packages. It is crucial for developers to remove this package and monitor their dependencies for vulnerabilities.
See every vulnerability recorded for munir-teaars-sdaa →
FAQ
The vulnerability involves malicious code that modifies package.json and republishes variants to the npm registry, compromising the integrity of the ecosystem.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
Remove the 'munir-teaars-sdaa' package from your project and update your dependencies to ensure you are not using any compromised versions.
While specific exploits have not been detailed, the malicious behavior of the package can lead to dependency confusion and potential exploitation by attackers.
Regularly audit your dependencies using tools like npm audit and stay informed about vulnerabilities in the packages you use.
