Malicious Code Injection in teaa-reborn40: npm Package Vulnerability
Summary
MAL-2025-166738: Malicious code in teaa-reborn40 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
teaa-reborn40 is an npm package that is part of the tea.xyz token reward campaign. It is designed to facilitate token rewards for developers by generating and publishing derivative packages. However, this package has been identified as malicious, containing scripts that manipulate package metadata and flood the npm registry with unwanted variants.
Vulnerability Detail
The vulnerability in teaa-reborn40 stems from its inclusion in a campaign that uses autopublish scripts to create and publish numerous derivative packages with randomized names. This malicious behavior modifies the package.json file by removing private flags, altering version numbers, and continuously republishing variants. The impact includes pollution of the npm registry and potential damage to developer reputation scores, as well as the risk of unintentional use of compromised packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall teaa-reborn40If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can avoid using teaa-reborn40 and any other packages associated with the tea.xyz token reward campaign. Regularly audit your package dependencies to ensure that no malicious packages are included in your project.
Conclusion
The teaa-reborn40 package poses a significant risk due to its malicious code that alters package metadata and floods the npm registry. It is crucial to remove this package and monitor your dependencies to maintain project integrity. Utilizing tools like Vulert can help in identifying and mitigating such vulnerabilities effectively.
See every vulnerability recorded for teaa-reborn40 →
FAQ
teaa-reborn40 is an npm package involved in the tea.xyz token reward campaign, which aims to reward developers through token incentives.
The malicious code can modify your package.json file, remove private flags, and flood the npm registry with unwanted package variants, potentially harming your project's integrity.
You should remove teaa-reborn40 from your project immediately and check for any other packages that may be part of the same malicious campaign.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software by analyzing the package-lock.json file. You can also check your application for vulnerabilities using the Vulert playground without any signup.
Regularly audit your dependencies, use tools like Vulert for monitoring, and stay updated on known vulnerabilities in the packages you use.
