Malicious Code Injection in particular_armadillo-appteadev Package
Summary
MAL-2025-106923: Malicious code in particular_armadillo-appteadev (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The particular_armadillo-appteadev package is part of the npm ecosystem and is designed to facilitate certain functionalities within applications. However, it has been identified as part of a malicious campaign that aims to manipulate the npm registry by generating and publishing derivative packages with randomized names. This behavior not only affects the integrity of the package but also poses a risk to developers who may unknowingly use it.
Vulnerability Detail
The vulnerability stems from the package's involvement in the tea.xyz token reward campaign, which has led to the creation of malicious scripts that modify the package.json file. These scripts remove private flags, alter version numbers, and generate random package names, ultimately leading to the pollution of the npm registry. The ramifications include compromised developer reputation scores and potential security risks for applications relying on these packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall particular_armadillo-appteadevIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the particular_armadillo-appteadev package from your project by executing the command: 'npm uninstall particular_armadillo-appteadev'. This will prevent any malicious code from executing until a secure version is available.
Conclusion
The particular_armadillo-appteadev package has been identified as a vector for malicious code that compromises the integrity of the npm registry. It is crucial for developers to stay informed about such vulnerabilities and take proactive measures to secure their applications.
See every vulnerability recorded for particular_armadillo-appteadev →
FAQ
The malicious code modifies the package.json file to remove private flags and changes version numbers, allowing for the continuous republishing of variants to the npm registry.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By utilizing the Vulert playground, you can check if your application is affected by this vulnerability without any signup.
Using this package can lead to compromised application integrity, security vulnerabilities, and inflated developer reputation scores due to the malicious behavior of the package.
Regularly auditing your dependencies and using tools like Vulert can help identify and mitigate vulnerabilities in your open-source packages.
If an immediate update is not possible, consider removing the package from your project as a temporary measure to mitigate risks.
