Malicious Code Injection in teagood-nalikami113: A Threat to npm Ecosystem
Summary
MAL-2025-167386: Malicious code in teagood-nalikami113 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
teagood-nalikami113 is an npm package that appears to be part of a token reward campaign associated with the tea.xyz project. This package is designed to manipulate the npm registry by generating and publishing derivative packages with randomized names, aimed at inflating developer reputation scores for token rewards. Its functionality is compromised due to the presence of malicious scripts that alter package metadata.
Vulnerability Detail
The vulnerability in teagood-nalikami113 originates from its inclusion in a series of malicious packages that flood the npm ecosystem. These packages contain scripts that automatically modify the package.json file, removing private flags, changing version numbers, and generating random package names. This behavior leads to the continuous republishing of variants, polluting the npm registry and potentially compromising the integrity of dependent projects. The malicious payload can lead to unauthorized access and manipulation of project dependencies.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall teagood-nalikami113If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider using a package-lock.json file to lock your dependencies and prevent the installation of malicious packages. You can also monitor your dependencies using tools like Vulert, which can alert you to vulnerabilities in real-time without requiring code access or installation.
Conclusion
The presence of malicious code in teagood-nalikami113 poses a significant risk to the npm ecosystem. It is crucial to take immediate action by removing the affected package and monitoring your project for vulnerabilities. Utilizing tools like Vulert can help maintain the security of your dependencies.
See every vulnerability recorded for teagood-nalikami113 →
FAQ
teagood-nalikami113 is an npm package involved in a token reward campaign that has been identified as malicious.
The vulnerability can lead to unauthorized modifications of your project's dependencies, potentially compromising security and stability.
You should uninstall the package immediately using npm uninstall teagood-nalikami113.
You can use Vulert to monitor your package-lock.json for vulnerabilities in real-time without needing to install additional tools.
Regularly audit your dependencies and use tools like Vulert to stay informed about potential vulnerabilities.
