Malicious Code Injection in teagood-sukuna69: A Threat to npm Ecosystem
Summary
MAL-2025-167825: Malicious code in teagood-sukuna69 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
teagood-sukuna69 is a package within the npm ecosystem, part of the tea.xyz token reward campaign. This campaign has been known to flood the npm registry with packages that contain malicious scripts. The primary function of these packages is to manipulate developer reputation scores through automated publishing of derivative packages, which can lead to significant pollution of the npm registry.
Vulnerability Detail
The vulnerability in teagood-sukuna69 stems from its inclusion in a malicious campaign that utilizes autopublish scripts to generate and publish numerous derivative packages with randomized names. This not only inflates developer reputation scores but also modifies the package.json file to remove private flags, alters version numbers, and continuously republishes variants. The ramifications of this vulnerability include potential security risks for developers who unknowingly integrate these malicious packages into their projects, leading to compromised applications and loss of trust in the npm ecosystem.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall teagood-sukuna69If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the teagood-sukuna69 package and consider using alternative packages that provide similar functionality without the associated risks. Additionally, regularly audit your npm packages using tools like npm audit to identify and mitigate vulnerabilities.
Conclusion
The teagood-sukuna69 package poses a significant risk due to its malicious nature, which can compromise the integrity of applications using it. Developers are urged to remove this package and monitor their projects for vulnerabilities to maintain security and trust in the npm ecosystem.
See every vulnerability recorded for teagood-sukuna69 →
FAQ
teagood-sukuna69 is an npm package that is part of a malicious campaign aimed at manipulating developer reputation scores through automated publishing.
The vulnerability can lead to the inclusion of malicious code in your project, potentially compromising its security and integrity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you have used teagood-sukuna69, it is crucial to uninstall it immediately and audit your project for any dependencies that may have been affected.
Yes, tools like npm audit and Vulert can help you identify and manage vulnerabilities in your npm packages effectively.
