Malicious Code Injection in teagood-nalikoli6: npm Package Vulnerability
Summary
MAL-2025-167616: Malicious code in teagood-nalikoli6 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
teagood-nalikoli6 is an npm package that is part of the tea.xyz token reward campaign. This package is designed to facilitate token rewards for developers by generating and publishing derivative packages. However, it has been identified as malicious due to its functionality that modifies package.json files and inflates developer reputation scores through automated scripts.
Vulnerability Detail
The vulnerability in teagood-nalikoli6 stems from its malicious payload, which alters the package.json file by removing private flags and changing version numbers. It generates random package names, primarily themed around Indonesian culture, and continuously republishes these variants to pollute the npm registry. This behavior can lead to significant security risks, including the potential for dependency confusion and the introduction of untrusted code into projects that rely on this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall teagood-nalikoli6If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the teagood-nalikoli6 package altogether. If it is already in use, consider removing it from your package.json and running npm install to clean up your dependencies.
Conclusion
The teagood-nalikoli6 npm package has been identified as a security risk due to its malicious code that alters package.json files and publishes untrusted packages. It is crucial for developers to remove this package and monitor their dependencies for vulnerabilities. Utilizing tools like Vulert can help in identifying such risks in real-time.
See every vulnerability recorded for teagood-nalikoli6 →
FAQ
The main issue is that it contains malicious code that modifies package.json files and publishes untrusted packages to the npm registry.
You can use Vulert, which monitors open-source vulnerabilities in your software using just package-lock.json. Visit Vulert Scanner to check for vulnerabilities without signing up.
If you have installed teagood-nalikoli6, it is advisable to remove it immediately and check for any alternative packages that do not pose security risks.
Yes, the malicious payload can lead to dependency confusion and the introduction of untrusted code, which can compromise the security of applications relying on this package.
If a patched version is released, updating the package will fix the issue. Always check the npm registry for the latest updates.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
