Malicious Code Injection in teaa-reborn31: A Threat to npm Ecosystem
Summary
MAL-2025-166728: Malicious code in teaa-reborn31 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
teaa-reborn31 is an npm package that is part of the tea.xyz token reward campaign. This package is designed to facilitate the distribution of token rewards through various scripts. However, it has been identified as malicious due to its capability to manipulate package metadata and flood the npm registry with derivative packages, which can mislead developers and inflate reputation scores.
Vulnerability Detail
The vulnerability in teaa-reborn31 originates from its malicious code that modifies the package.json file. This code removes private flags, alters version numbers, and generates random package names, which allows it to continuously republish variants to the npm registry. The ramifications include pollution of the npm registry, potential security risks for developers using these packages, and a compromised reputation system within the npm ecosystem.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall teaa-reborn31If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using teaa-reborn31 and monitor your package-lock.json file for any unauthorized changes. Regularly audit your npm packages using npm audit to identify any vulnerabilities.
Conclusion
The teaa-reborn31 package poses a significant threat to the npm ecosystem due to its malicious code that modifies package metadata and floods the registry. It is crucial for developers to be vigilant, remove affected packages, and utilize tools like Vulert to monitor for vulnerabilities.
See every vulnerability recorded for teaa-reborn31 →
FAQ
teaa-reborn31 is an npm package associated with the tea.xyz token reward campaign, which has been identified as malicious.
The vulnerability can lead to the pollution of the npm registry and may introduce security risks if your project inadvertently uses compromised packages.
You should uninstall teaa-reborn31 immediately and monitor your project for any unauthorized changes.
Yes, you can use tools like Vulert, which monitors your package-lock.json for open-source vulnerabilities in real-time.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
