Malicious Code Injection in remarkable_condor-toolteadev Package
Summary
MAL-2025-107886: Malicious code in remarkable_condor-toolteadev (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The remarkable_condor-toolteadev package is part of the npm ecosystem, often utilized for development tools and utilities. However, it has been identified as part of a malicious campaign that exploits npm's package publishing system. This vulnerability allows attackers to manipulate the package's metadata and publish harmful variants, potentially affecting users who rely on this package for their development needs.
Vulnerability Detail
The vulnerability originates from a malicious campaign associated with the tea.xyz token reward initiative. It involves the use of scripts that automatically generate and publish derivative packages with altered metadata, including the removal of private flags and the modification of version numbers. This can lead to the pollution of the npm registry, making it difficult for developers to trust the integrity of packages. The malicious payload can compromise the security of applications that depend on this package, leading to potential data breaches or exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall remarkable_condor-toolteadevIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the remarkable_condor-toolteadev package from your project until a secure version is released. You can do this by executing the following command: npm uninstall remarkable_condor-toolteadev. Additionally, monitor your package-lock.json file for any unexpected changes.
Conclusion
The remarkable_condor-toolteadev package has been identified as a vector for malicious code injection, posing significant risks to developers and their applications. It is crucial to take immediate action by updating or removing the package and utilizing tools like Vulert to monitor for vulnerabilities in your projects.
See every vulnerability recorded for remarkable_condor-toolteadev →
FAQ
It is a development tool package within the npm ecosystem, but it has been compromised by malicious scripts.
You can use Vulert, which monitors vulnerabilities in open-source packages. Visit Vulert Scanner to check your application without needing to sign up.
You should uninstall the package immediately and monitor for any updates or patches from the maintainers.
Yes, using this package can expose your application to security risks, including data breaches and exploitation due to the malicious code.
Regularly audit your dependencies, use tools like Vulert for monitoring, and stay updated on security advisories related to the packages you use.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
