Malicious Code Exploit in tealove-dana36: A Threat to npm Users
Summary
MAL-2025-168243: Malicious code in tealove-dana36 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package tealove-dana36 is part of a broader campaign associated with the tea.xyz token reward initiative. This npm package is designed to facilitate the generation and publication of derivative packages, often with randomized names, to artificially inflate developer reputation scores for token rewards. Its functionality is primarily centered around automating the publishing process, which, while useful, has been exploited for malicious purposes.
Vulnerability Detail
The vulnerability in tealove-dana36 stems from its inclusion in a malicious campaign that modifies the package.json file to remove private flags, alters version numbers, and generates random package names. This behavior leads to the continuous republishing of variants, which clutters the npm registry and can potentially introduce harmful code into dependent projects. The malicious payload is designed to exploit the npm ecosystem, making it crucial for developers to be aware of such threats.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tealove-dana36If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the tealove-dana36 package from your project by executing: npm uninstall tealove-dana36. Additionally, consider using tools like Vulert to monitor your package-lock.json for vulnerabilities in real-time.
Conclusion
The tealove-dana36 package poses a significant risk due to its malicious code designed to exploit the npm ecosystem. Developers are urged to take immediate action by updating or removing the package and utilizing tools like Vulert for ongoing monitoring. Awareness and proactive measures are essential in safeguarding against such vulnerabilities.
See every vulnerability recorded for tealove-dana36 →
FAQ
The primary risk is the potential for malicious code execution due to the package's ability to modify project files and republish variants, which can lead to security breaches.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider removing the package and monitoring your project for any unusual behavior or vulnerabilities.
Yes, tools like Vulert can monitor your package-lock.json for vulnerabilities and alert you in real-time, helping you maintain a secure environment.
Regularly update your dependencies, use automated security tools, and review package sources before installation to avoid malicious packages.
