Malicious Code Injection in tealove-boy50: A Threat to npm Ecosystem
Summary
MAL-2025-168159: Malicious code in tealove-boy50 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package tealove-boy50 is part of a broader campaign targeting the npm ecosystem, specifically linked to the tea.xyz token reward initiative. This package is designed to manipulate npm's publishing system by creating derivative packages with randomized names, which can mislead developers and inflate reputation scores for token rewards. Its functionality is compromised, making it a vector for malicious activities.
Vulnerability Detail
The vulnerability in tealove-boy50 originates from its design to include autopublish scripts that modify the package.json file. These modifications remove private flags, alter version numbers, and generate random package names, leading to the continuous republishing of variants. This behavior not only pollutes the npm registry but also poses risks such as unintentional dependency on malicious packages and potential exploitation of developer reputation systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tealove-boy50If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid using the tealove-boy50 package and monitor your package-lock.json for any unauthorized changes. You can also use the following command to audit your npm packages for vulnerabilities: 'npm audit'.
Conclusion
The tealove-boy50 package poses a significant risk to the npm ecosystem due to its malicious code and behavior. It is crucial for developers to be aware of such vulnerabilities, take immediate action to remove affected packages, and implement monitoring tools like Vulert to safeguard their applications.
See every vulnerability recorded for tealove-boy50 →
FAQ
tealove-boy50 is an npm package associated with a token reward campaign that manipulates the npm registry by creating and publishing malicious derivative packages.
This vulnerability can lead to the introduction of malicious code into your project, potentially compromising your application's security and integrity.
You should uninstall the package immediately using 'npm uninstall tealove-boy50' and check your project for any unauthorized changes.
You can use tools like Vulert, which monitors your package-lock.json for vulnerabilities in real-time. You can also check your application against known vulnerabilities using the Vulert playground without signing up.
Regularly audit your dependencies, keep your packages updated, and utilize tools like Vulert to monitor for vulnerabilities in real-time.
