Malicious Code Vulnerability in teaa-reborn49 Package
Summary
MAL-2025-166746: Malicious code in teaa-reborn49 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The teaa-reborn49 package is part of the tea.xyz token reward campaign that has infiltrated the npm ecosystem. It is designed to facilitate the automatic generation and publication of derivative packages, which are often used to inflate developer reputation scores for token rewards. This package, like others in its category, contains scripts that manipulate package metadata and continuously republish variants to the npm registry, leading to potential abuse and pollution of the ecosystem.
Vulnerability Detail
The vulnerability in teaa-reborn49 arises from its malicious code that modifies the package.json file by removing private flags, altering version numbers, and generating random package names. This behavior is intended to create a flood of derivative packages in the npm registry, which can mislead users and inflate the reputation of developers involved in the tea protocol token rewards. The origin of this vulnerability is linked to the broader campaign that exploits npm's publishing mechanisms, posing risks such as reputation damage for legitimate developers and potential security risks for users who inadvertently install these packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall teaa-reborn49If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the teaa-reborn49 package and instead rely on alternative packages that provide similar functionality without the associated risks. Additionally, ensure that your package-lock.json is monitored for any unauthorized changes.
Conclusion
The teaa-reborn49 package poses a significant risk due to its malicious code designed to manipulate npm's publishing system. It is essential to remove this package from your projects and monitor for any similar vulnerabilities using tools like Vulert. Staying informed and proactive can help safeguard your applications from such threats.
See every vulnerability recorded for teaa-reborn49 →
FAQ
teaa-reborn49 is an npm package that is part of a campaign to generate and publish derivative packages for token rewards, often containing malicious code.
The vulnerability can lead to the pollution of the npm registry, potential security risks, and damage to your project's reputation if malicious packages are inadvertently included.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
You should uninstall the teaa-reborn49 package immediately using the command: npm uninstall teaa-reborn49.
Yes, Vulert can monitor your package-lock.json for open-source vulnerabilities in real-time, alerting you to any issues.
