Malicious Code Detected in slippery_alligator-appteadev Package - npm Vulnerability
Summary
MAL-2025-108833: Malicious code in slippery_alligator-appteadev (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The slippery_alligator-appteadev package is part of the npm ecosystem, which is widely used for JavaScript package management. This package is associated with the tea.xyz token reward campaign, which has been known to flood the npm registry with malicious packages. The primary function of this package is to facilitate the automatic generation and publication of derivative packages, which can inflate developer reputation scores for token rewards. However, this functionality has been compromised, leading to significant security concerns.
Vulnerability Detail
The vulnerability in the slippery_alligator-appteadev package stems from its malicious code that modifies the package.json file. This code removes private flags, alters version numbers, and generates random package names, which are often themed around Indonesian culture. The malicious payload continuously republishes these variants, polluting the npm registry and potentially compromising other projects that depend on this package. The origin of this vulnerability is linked to a broader campaign aimed at exploiting npm for token rewards, making it a significant threat to developers and users alike.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall slippery_alligator-appteadevIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If an immediate update is not possible, consider removing the slippery_alligator-appteadev package from your project and replacing it with a safer alternative. You can uninstall it using the command: npm uninstall slippery_alligator-appteadev.
Conclusion
The slippery_alligator-appteadev package poses a significant security risk due to its malicious code that modifies essential project files and repopulates the npm registry with harmful variants. It is essential for developers to take immediate action by updating or removing this package to safeguard their projects.
See every vulnerability recorded for slippery_alligator-appteadev →
FAQ
It is an npm package associated with the tea.xyz token reward campaign, designed to generate and publish derivative packages.
The malicious code can compromise your project's integrity by modifying package.json and introducing unwanted packages, which may lead to security breaches.
You should immediately update or uninstall the slippery_alligator-appteadev package to prevent potential security risks.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just package-lock.json. You can check your application for vulnerabilities using the Vulert playground without any signup.
Regularly update your packages, use tools like Vulert for monitoring vulnerabilities, and review your dependencies for any known issues.
