Malicious Code Injection in ordinary_goat-excellentdev Package
Summary
MAL-2025-106771: Malicious code in ordinary_goat-excellentdev (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ordinary_goat-excellentdev package is part of the npm ecosystem, typically used for various development tasks. However, it has been identified as part of a malicious campaign that aims to exploit npm's package publishing system. This package is associated with the tea.xyz token reward initiative, which has led to the proliferation of numerous malicious packages designed to inflate developer reputation scores.
Vulnerability Detail
The vulnerability stems from the presence of malicious code within the ordinary_goat-excellentdev package. This code modifies the package.json file by removing private flags, altering version numbers, and generating random package names. The malicious payload is designed to continuously republish these variants, thereby polluting the npm registry and potentially compromising the integrity of other packages. The origin of this vulnerability is linked to the tea.xyz token reward campaign, which has flooded npm with similar malicious packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall ordinary_goat-excellentdevIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the ordinary_goat-excellentdev package until a fix is confirmed. Additionally, consider using npm audit to identify and address vulnerabilities in your project's dependencies.
Conclusion
The ordinary_goat-excellentdev package has been identified as containing malicious code that poses a significant risk to developers using npm. It is crucial to take immediate action by updating or removing the package to safeguard your projects. Utilizing tools like Vulert can help you stay informed about vulnerabilities in your dependencies.
See every vulnerability recorded for ordinary_goat-excellentdev →
FAQ
ordinary_goat-excellentdev is an npm package that is part of a malicious campaign aimed at exploiting the npm registry.
The vulnerability can lead to the modification of your package.json file and the introduction of malicious code, potentially compromising your project's integrity.
If you have installed the ordinary_goat-excellentdev package, you should remove it and update your dependencies to ensure your project is secure.
You can use tools like Vulert, which monitors your package-lock.json file to alert you in real-time about open-source vulnerabilities in your software.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
