Malicious Code Injection in teagood-nakama16: npm Package Vulnerability
Summary
MAL-2025-167179: Malicious code in teagood-nakama16 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
teagood-nakama16 is an npm package that is part of the tea.xyz token reward campaign. This package is designed to facilitate token rewards for developers by allowing them to publish packages to the npm registry. However, it has been identified as containing malicious code that compromises its integrity and the security of the npm ecosystem.
Vulnerability Detail
The vulnerability in teagood-nakama16 stems from its inclusion in a series of malicious packages that automate the generation and publication of derivative packages. These packages contain scripts that modify the package.json file to remove private flags, alter version numbers, and create random package names, ultimately leading to pollution of the npm registry. This behavior can inflate developer reputation scores fraudulently and may expose users to further security risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall teagood-nakama16If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the teagood-nakama16 package from your project to prevent any malicious activity. Use the following command:
npm uninstall teagood-nakama16
Conclusion
The teagood-nakama16 package has been identified as containing malicious code that can compromise the integrity of your project and the npm ecosystem. It is crucial to take immediate action by updating or removing the package to safeguard your application from potential threats.
See every vulnerability recorded for teagood-nakama16 →
FAQ
The primary risk is the potential for malicious code to alter your project's dependencies and publish unauthorized packages, which can lead to security breaches.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without requiring any signup.
If you cannot update the package, the best course of action is to uninstall it to mitigate any risks associated with the vulnerability.
While specific exploits have not been detailed, the malicious behavior of the package itself poses a significant risk to users and the npm registry.
Regularly audit your dependencies, use tools like Vulert for monitoring, and stay informed about known vulnerabilities in the packages you use.
