Malicious Code Injection in tealove-aruma13: A Threat to npm Ecosystem
Summary
MAL-2025-168067: Malicious code in tealove-aruma13 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package tealove-aruma13 is part of the tea.xyz token reward campaign, which has been associated with a series of malicious npm packages. These packages are designed to manipulate the npm registry by automatically generating and publishing derivative packages with randomized names. This behavior not only inflates developer reputation scores for token rewards but also poses a significant risk to the integrity of the npm ecosystem.
Vulnerability Detail
The vulnerability in tealove-aruma13 originates from its malicious payload that modifies the package.json file. It removes private flags, alters version numbers, and generates random package names, leading to the continuous republishing of variants. This behavior can pollute the npm registry, making it difficult for developers to find legitimate packages and potentially introducing security risks into their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tealove-aruma13If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the installation of the tealove-aruma13 package by using npm's package-lock.json to monitor dependencies. If you are using Vulert, you can check your application for vulnerabilities without installation by visiting the Vulert playground at https://vulert.com/scanner.
Conclusion
The tealove-aruma13 package poses a significant risk due to its malicious behavior, which can compromise the integrity of the npm ecosystem. It is crucial for developers to remove this package and monitor their applications for vulnerabilities. Utilizing tools like Vulert can help in real-time monitoring and alerting for such issues.
See every vulnerability recorded for tealove-aruma13 →
FAQ
Tealove-aruma13 is an npm package associated with the tea.xyz token reward campaign, which has been identified as malicious.
The vulnerability can lead to the pollution of the npm registry, making it difficult to find legitimate packages and potentially introducing security risks.
You should remove the package from your project and monitor for any updates or patches that may address the vulnerability.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software using just package-lock.json.
You can find more information in the vulnerability report on the GitHub repository or by using Vulert's tools.
