Malicious Code Injection in qcuzbt-devapptea Package
Summary
MAL-2025-107561: Malicious code in qcuzbt-devapptea (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The qcuzbt-devapptea package is part of the tea.xyz token reward campaign, which has been known to flood the npm ecosystem with various packages. These packages are designed to inflate developer reputation scores by automatically generating and publishing derivative packages with randomized names. This behavior poses significant risks to developers and users relying on the integrity of npm packages.
Vulnerability Detail
The vulnerability in the qcuzbt-devapptea package stems from its inclusion in a malicious campaign that modifies the package.json file to remove private flags, alters version numbers, and generates random package names. This malicious payload allows the package to continuously republish variants, polluting the npm registry and potentially compromising the security and reliability of applications that depend on it. The origin of this vulnerability is linked to the tea.xyz token reward initiative, which incentivizes the creation of such malicious packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall qcuzbt-devappteaIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can prevent the installation of this malicious package by using npm's package-lock.json to monitor your dependencies. Ensure that you do not include qcuzbt-devapptea in your package.json file. Additionally, consider using tools like Vulert to monitor for vulnerabilities in your project. You can check if your application is affected by this vulnerability using the Vulert playground at https://vulert.com/scanner without any signup.
Conclusion
The qcuzbt-devapptea package poses a significant security risk due to its malicious code that modifies package configurations and repopulates the npm registry with harmful variants. It is crucial for developers to remove this package and utilize monitoring tools to safeguard their applications against such vulnerabilities.
See every vulnerability recorded for qcuzbt-devapptea →
FAQ
qcuzbt-devapptea is an npm package associated with the tea.xyz token reward campaign, which aims to inflate developer reputation scores through the automatic generation of derivative packages.
The malicious code modifies your package.json file, removes private flags, and continuously republishes variants, which can lead to security vulnerabilities and instability in your application.
You should remove the qcuzbt-devapptea package from your project immediately to mitigate any potential risks associated with its malicious behavior.
Yes, regularly monitor your dependencies using tools like Vulert, which can alert you to open-source vulnerabilities in real-time without requiring code access.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by vulnerabilities without any signup.
