Malicious Code Injection in silly_jaguar-apptea: npm Package Vulnerability
Summary
MAL-2025-108685: Malicious code in silly_jaguar-apptea (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'silly_jaguar-apptea' package is part of the tea.xyz token reward campaign that has infiltrated the npm ecosystem. It is designed to automate the generation and publication of derivative packages, which can inflate developer reputation scores in exchange for tea protocol token rewards. This package is particularly concerning due to its ability to modify critical files and republish malicious variants.
Vulnerability Detail
The vulnerability originates from the package's malicious payload, which alters the package.json file by removing private flags, changing version numbers, and generating random package names. This behavior leads to the continuous republishing of these variants, polluting the npm registry and potentially compromising the integrity of dependent applications. The malicious code is designed to exploit the npm ecosystem for nefarious purposes, making it a significant security risk.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall silly_jaguar-appteaIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the 'silly_jaguar-apptea' package from your project by executing the command: 'npm uninstall silly_jaguar-apptea'. This will prevent any malicious code from executing until a fix is applied.
Conclusion
The 'silly_jaguar-apptea' package presents a significant security risk due to its malicious code designed to manipulate npm packages. It is crucial to take immediate action by updating or removing the package to safeguard your application from potential threats.
See every vulnerability recorded for silly_jaguar-apptea →
FAQ
The impact includes potential exposure to malicious code that can modify your project's dependencies and compromise the integrity of your application.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check your application without any signup.
If immediate updates are not feasible, consider removing the package as a temporary measure to prevent exploitation.
Yes, the malicious payload is designed to republish variants of the package, which can lead to further exploitation within the npm ecosystem.
Regularly monitor your dependencies using tools like Vulert, and subscribe to security advisories related to the packages you use.
