Malicious Code Injection in present_monkey-apptea Package
Summary
MAL-2025-107228: Malicious code in present_monkey-apptea (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The present_monkey-apptea package is part of the tea.xyz token reward campaign, which has been associated with a series of malicious packages flooding the npm registry. This package is designed to interact with the npm ecosystem, but it has been compromised to include harmful scripts that can manipulate package metadata and inflate developer reputation scores.
Vulnerability Detail
The vulnerability in present_monkey-apptea originates from its association with a malicious campaign that employs scripts to automatically publish derivative packages with randomized names. These scripts modify the package.json file to remove private flags, alter version numbers, and continuously republish variants, thereby polluting the npm registry. This can lead to security risks, including unauthorized access to sensitive data and potential exploitation of affected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall present_monkey-appteaIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can prevent the installation of this package by using npm's package-lock.json to monitor dependencies. Ensure that you do not include present_monkey-apptea in your project's dependencies. You can also use the following command to uninstall it: npm uninstall present_monkey-apptea.
Conclusion
The present_monkey-apptea package has been identified as containing malicious code that can compromise the security of projects using it. It is crucial to remove this package and monitor your dependencies for vulnerabilities to ensure the safety of your application.
See every vulnerability recorded for present_monkey-apptea →
FAQ
present_monkey-apptea is an npm package associated with the tea.xyz token reward campaign, which has been compromised to include malicious code.
The malicious code modifies package metadata and can lead to the publication of unauthorized packages, potentially compromising your project's integrity and security.
You should uninstall the present_monkey-apptea package immediately to mitigate any security risks associated with its malicious code.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground.
You can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without requiring any signup.
