Malicious Code Injection in teagood-sukuna16: A Threat to npm Ecosystem
Summary
MAL-2025-167768: Malicious code in teagood-sukuna16 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
teagood-sukuna16 is a package within the npm ecosystem that is part of a broader token reward campaign associated with the tea.xyz protocol. This package, like others in the campaign, is designed to manipulate npm's publishing system, potentially compromising the integrity of the registry and affecting developers' reputations.
Vulnerability Detail
The vulnerability in teagood-sukuna16 arises from its inclusion in a malicious campaign that employs autopublish scripts to generate and publish numerous derivative packages with randomized names. These scripts modify the package.json file to remove private flags, alter version numbers, and continuously republish variants, leading to pollution of the npm registry. This not only affects the reputation of developers but also poses a risk of unintentional dependency on malicious packages by other developers.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall teagood-sukuna16If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can avoid using the teagood-sukuna16 package altogether. If it is already in use, consider removing it from your package.json and reinstalling your dependencies without it. Use the command: npm uninstall teagood-sukuna16.
Conclusion
The teagood-sukuna16 package poses a significant risk due to its malicious code designed to manipulate the npm registry. It is crucial for developers to be aware of such vulnerabilities and take necessary actions to protect their projects. Regular monitoring and updates are essential to maintain security.
See every vulnerability recorded for teagood-sukuna16 →
FAQ
teagood-sukuna16 is an npm package that is part of a malicious campaign aimed at manipulating the npm registry for token rewards.
The vulnerability can lead to the introduction of malicious code into your project, potentially compromising its security and integrity.
You should uninstall the package immediately and monitor your project for any unusual behavior.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json file.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
