Malicious Code Injection in pale_earwig-apptea: A Threat to npm Ecosystem
Summary
MAL-2025-106884: Malicious code in pale_earwig-apptea (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package pale_earwig-apptea is part of the npm ecosystem, which is widely used for JavaScript package management. This package is associated with the tea.xyz token reward campaign, which has been known to flood the npm registry with malicious packages. The primary function of this package is to participate in a reward system, but it has been compromised to execute harmful scripts that can affect developers and the integrity of the npm registry.
Vulnerability Detail
The vulnerability in pale_earwig-apptea stems from its inclusion in a malicious campaign that utilizes autopublish scripts to generate and publish derivative packages with randomized names. This behavior is designed to inflate developer reputation scores for token rewards. The malicious payload modifies the package.json file by removing private flags, altering version numbers, and continuously republishing variants, which can lead to pollution of the npm registry and potential exploitation of developers who unknowingly use these packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall pale_earwig-appteaIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the pale_earwig-apptea package and monitor your dependencies for any malicious activity. You can also utilize tools like Vulert to check for vulnerabilities in your project. To do this, you can use the Vulert playground at https://vulert.com/scanner without any signup to see if your application is affected by this vulnerability.
Conclusion
The pale_earwig-apptea package poses a significant risk due to its malicious code designed to manipulate the npm registry. It is essential to remove this package from your projects and monitor your dependencies for any vulnerabilities. Utilizing tools like Vulert can help ensure the security of your software.
See every vulnerability recorded for pale_earwig-apptea →
FAQ
pale_earwig-apptea is an npm package that is part of a token reward campaign but has been identified as malicious due to its harmful scripts.
The vulnerability can lead to the pollution of the npm registry and may compromise the integrity of your project by introducing malicious code.
You should uninstall the package immediately using the command: npm uninstall pale_earwig-apptea.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software by analyzing your package-lock.json.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without any signup.
