Malicious Code Injection in teagood-manaki29: A Threat to npm Users
Summary
MAL-2025-167093: Malicious code in teagood-manaki29 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
teagood-manaki29 is an npm package that is part of the tea.xyz token reward campaign. This package is designed to facilitate the distribution of token rewards by generating derivative packages. However, it has been identified as containing malicious code that compromises the integrity of the npm registry by publishing numerous variants of itself with altered metadata.
Vulnerability Detail
The vulnerability in teagood-manaki29 arises from its malicious payload, which modifies the package.json file to remove private flags and changes version numbers. It generates random package names, primarily themed around Indonesian culture, and continuously republishes these variants to pollute the npm registry. This behavior not only inflates developer reputation scores but also poses a significant risk to users who may unknowingly install these compromised packages, leading to potential security breaches in their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall teagood-manaki29If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the affected package by not including it in your dependencies. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The discovery of malicious code in the teagood-manaki29 package highlights the importance of vigilance when using open-source packages. Users are advised to remove the affected package and monitor their projects for vulnerabilities to maintain the security of their applications.
See every vulnerability recorded for teagood-manaki29 →
FAQ
teagood-manaki29 is an npm package involved in the tea.xyz token reward campaign, which has been identified as containing malicious code.
The malicious code modifies package metadata and publishes numerous variants, which can lead to security vulnerabilities in applications that use these packages.
You should uninstall the package immediately using 'npm uninstall teagood-manaki29' and check for any other affected packages in your project.
Yes, consider using other npm packages that provide similar functionalities without the associated risks. Always review package details before installation.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just package-lock.json. You can check your application for vulnerabilities using the Vulert playground at Vulert Scanner without any signup.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
