Malicious Code Injection in teagood-yakuna79: A Threat to npm Ecosystem
Summary
MAL-2025-167941: Malicious code in teagood-yakuna79 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
teagood-yakuna79 is an npm package that is part of the tea.xyz token reward campaign. This package is designed to facilitate the distribution of token rewards through various scripts. However, it has been identified as malicious, containing scripts that manipulate package metadata and flood the npm registry with derivative packages, thereby compromising the integrity of the ecosystem.
Vulnerability Detail
The vulnerability in teagood-yakuna79 originates from its malicious scripts that modify the package.json file to remove private flags, alter version numbers, and generate random package names. This behavior leads to the automatic generation and republishing of numerous variants, which can pollute the npm registry and inflate developer reputation scores fraudulently. The ramifications include potential security risks for developers relying on the integrity of the npm ecosystem and the possibility of malicious code being executed in dependent applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall teagood-yakuna79If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the affected package by replacing it with a similar, trusted package that provides the required functionality without the associated risks.
Conclusion
The discovery of malicious code in teagood-yakuna79 highlights the importance of vigilance when using open-source packages. Developers should take immediate action to remove this package and ensure their dependencies are secure. Regular audits and monitoring tools like Vulert can help maintain the integrity of your projects.
See every vulnerability recorded for teagood-yakuna79 →
FAQ
teagood-yakuna79 is an npm package involved in the tea.xyz token reward campaign, which has been identified as malicious.
The vulnerability can lead to the injection of malicious code into your application, compromising its security and integrity.
You should uninstall the package immediately using npm uninstall teagood-yakuna79 and audit your project for any other vulnerabilities.
No patches are available for teagood-yakuna79 as it is a malicious package. The best course of action is to remove it from your project.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json. You can check your application for vulnerabilities using the Vulert playground at Vulert Scanner.
