Malicious Code Injection in raw_wildebeest-appteadev Package
Summary
MAL-2025-107748: Malicious code in raw_wildebeest-appteadev (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The raw_wildebeest-appteadev package is part of the npm ecosystem, designed for application development. It is intended to facilitate the creation and management of applications within the npm framework. However, this package has been identified as part of a malicious campaign that exploits npm's publishing capabilities, leading to significant security concerns.
Vulnerability Detail
The vulnerability stems from the package being associated with the tea.xyz token reward campaign, which floods the npm registry with malicious packages. These packages contain scripts that automatically modify the package.json file, removing private flags and changing version numbers. They generate random package names and continuously republish variants, which can lead to reputation inflation and registry pollution. This malicious behavior can compromise the integrity of the npm ecosystem and potentially expose users to further attacks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall raw_wildebeest-appteadevIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the raw_wildebeest-appteadev package and look for alternative packages that provide similar functionality without the associated risks. Additionally, you can monitor your package-lock.json file for any unauthorized changes.
Conclusion
The raw_wildebeest-appteadev package poses a significant security risk due to its malicious code that modifies project files and floods the npm registry. It is crucial to remove this package and monitor your applications for any vulnerabilities. Utilizing tools like Vulert can help maintain the security of your software.
See every vulnerability recorded for raw_wildebeest-appteadev →
FAQ
It is an npm package intended for application development but has been compromised with malicious code.
The vulnerability can lead to unauthorized modifications in your package.json file, potentially compromising your application's integrity and security.
You should remove the raw_wildebeest-appteadev package from your project immediately and monitor for any unauthorized changes.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using just the package-lock.json file, providing real-time insights.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
