Malicious Code Injection in teagood-yakuza49: A Threat to npm Packages
Summary
MAL-2025-168007: Malicious code in teagood-yakuza49 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
teagood-yakuza49 is an npm package that is part of the tea.xyz token reward campaign. This package is designed to reward developers with tokens for their contributions. However, it has been identified as containing malicious scripts that can compromise the integrity of the npm registry and the developer's reputation. The package is known for generating and publishing derivative packages with randomized names, which can lead to pollution of the npm ecosystem.
Vulnerability Detail
The vulnerability in teagood-yakuza49 originates from its inclusion in a campaign that floods npm with malicious packages. These packages contain scripts that modify the package.json file to remove private flags, alter version numbers, and generate random package names. This behavior not only inflates developer reputation scores but also poses a significant risk of registry pollution, making it difficult for legitimate packages to be discovered and used. The malicious payload can lead to unauthorized access to sensitive data and compromise the security of applications relying on these packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall teagood-yakuza49If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the teagood-yakuza49 package and any other packages associated with the tea.xyz token reward campaign. Additionally, consider using the following command to uninstall the package: npm uninstall teagood-yakuza49.
Conclusion
The teagood-yakuza49 package poses a significant threat due to its malicious code that can compromise the npm registry and developer reputation. It is crucial to remove this package from your projects and monitor for any updates or patches. Utilizing tools like Vulert can help you stay informed about vulnerabilities in your dependencies.
See every vulnerability recorded for teagood-yakuza49 →
FAQ
teagood-yakuza49 is an npm package associated with the tea.xyz token reward campaign, which aims to reward developers for their contributions.
The package contains scripts that modify package.json files, remove private flags, and generate random package names, leading to npm registry pollution.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without requiring signup.
It is recommended to uninstall the package immediately using the command: npm uninstall teagood-yakuza49.
Yes, using this package can lead to unauthorized access to sensitive data and compromise the security of your applications.
