Malicious Code Injection in teagood-nakama87: A Threat to npm Users
Summary
MAL-2025-167256: Malicious code in teagood-nakama87 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
teagood-nakama87 is an npm package that appears to be part of a broader campaign associated with the tea.xyz token reward initiative. This package is designed to facilitate the automatic generation and publication of derivative packages, which can inflate developer reputation scores in exchange for tea protocol token rewards. Its functionality is compromised due to the presence of malicious scripts that manipulate package metadata.
Vulnerability Detail
The vulnerability in teagood-nakama87 originates from its inclusion in a malicious campaign that floods the npm registry with derivative packages. The malicious payload modifies the package.json file by removing private flags, altering version numbers, and generating random package names. This behavior not only pollutes the npm registry but also poses a risk to developers who may unknowingly use these compromised packages, potentially leading to reputational damage and security risks in their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall teagood-nakama87If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the teagood-nakama87 package from your project by executing: npm uninstall teagood-nakama87. This will prevent any malicious scripts from executing until a secure version is available.
Conclusion
The vulnerability in teagood-nakama87 poses a significant threat to npm users, primarily due to its malicious code that alters package metadata and publishes compromised derivatives. It is essential to take immediate action by updating or removing the package to safeguard your applications.
See every vulnerability recorded for teagood-nakama87 →
FAQ
The primary risk is the potential for malicious code execution, which can compromise the integrity of applications using this package.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
If an immediate update is not possible, consider removing the package from your project to mitigate risks until a secure version is available.
While specific exploits have not been detailed, the nature of the malicious payload suggests that it could lead to significant security breaches if left unaddressed.
Regularly audit your dependencies, utilize tools like Vulert for monitoring, and stay informed about security advisories related to the packages you use.
