Malicious Code Injection in sole_tarantula-appteadev: A Threat to npm Users
Summary
MAL-2025-108910: Malicious code in sole_tarantula-appteadev (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'sole_tarantula-appteadev' is part of the npm ecosystem, primarily used for JavaScript development. It is associated with the tea.xyz token reward campaign, which has been known to flood the npm registry with malicious packages. This package, like others in the campaign, is designed to manipulate the npm ecosystem for fraudulent purposes, including inflating developer reputation scores.
Vulnerability Detail
The vulnerability in 'sole_tarantula-appteadev' stems from its inclusion in a malicious campaign that deploys scripts to automatically generate and publish derivative packages with randomized names. These scripts modify the package.json file to remove private flags, alter version numbers, and continuously republish variants, leading to pollution of the npm registry. The malicious payload can compromise the integrity of the npm ecosystem, potentially affecting developers who rely on these packages for their projects.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall sole_tarantula-appteadevIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can avoid using the 'sole_tarantula-appteadev' package and replace it with a trusted alternative. Always verify the source and integrity of packages before including them in your project.
Conclusion
The 'sole_tarantula-appteadev' package poses a significant risk due to its malicious code designed to manipulate the npm ecosystem. It is essential for developers to remove this package and monitor their dependencies regularly to maintain the integrity of their applications.
See every vulnerability recorded for sole_tarantula-appteadev →
FAQ
The primary risk is the potential for malicious code execution, which can compromise your application and lead to unauthorized access or data corruption.
You can check your package-lock.json file for any references to 'sole_tarantula-appteadev'. Additionally, using tools like Vulert can help monitor and alert you for vulnerabilities in real-time.
Immediately uninstall the package using 'npm uninstall sole_tarantula-appteadev' and replace it with a trusted alternative. Review your project for any potential impacts caused by the malicious code.
Yes, regularly audit your dependencies, use tools like Vulert for monitoring, and only install packages from reputable sources.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
