Malicious Code Injection in teagood-nalikami129: A Threat to npm Ecosystem
Summary
MAL-2025-167403: Malicious code in teagood-nalikami129 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
teagood-nalikami129 is an npm package that is part of a broader campaign associated with the tea.xyz token reward system. This package is designed to manipulate the npm registry by generating and publishing numerous derivative packages with randomized names. Its primary function is to inflate developer reputation scores in exchange for token rewards, making it a target for malicious exploitation.
Vulnerability Detail
The vulnerability in teagood-nalikami129 stems from its inclusion in a malicious package campaign that modifies the package.json file to remove private flags and alters version numbers. It generates random package names, often themed around Indonesian culture, and continuously republishes these variants, leading to pollution of the npm registry. This behavior can compromise the integrity of the npm ecosystem and potentially expose users to further malicious activities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall teagood-nalikami129If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the teagood-nalikami129 package and any other packages associated with the tea.xyz token reward campaign. Monitor your project for any dependencies that may have been inadvertently included and remove them as necessary.
Conclusion
The teagood-nalikami129 package poses a significant risk to the npm ecosystem due to its malicious behavior aimed at manipulating package reputation scores. It is essential to remove this package and monitor your dependencies for any vulnerabilities to maintain the integrity of your project.
See every vulnerability recorded for teagood-nalikami129 →
FAQ
teagood-nalikami129 is an npm package involved in a malicious campaign aimed at manipulating the npm registry for token rewards.
The vulnerability can lead to the pollution of the npm registry and may expose your project to further malicious activities.
You should uninstall the package immediately using 'npm uninstall teagood-nalikami129' and check for any other affected dependencies.
There are no patches available for teagood-nalikami129 as it is recommended to remove the package entirely.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just package-lock.json. You can check your application for vulnerabilities without signup at the Vulert playground.
