Malicious Code Injection in tealove-nameka19: A Threat to npm Packages
Summary
MAL-2025-168400: Malicious code in tealove-nameka19 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tealove-nameka19 is an npm package that appears to be part of a token reward campaign associated with the tea.xyz protocol. It is designed to facilitate the generation and publication of derivative packages, often with randomized names, to inflate developer reputation scores. This package is part of a larger trend of malicious npm packages that exploit the npm ecosystem.
Vulnerability Detail
The vulnerability in tealove-nameka19 stems from its malicious code that modifies the package.json file to remove private flags and alters version numbers. It generates random package names, primarily themed around Indonesian culture, and continuously republishes these variants to pollute the npm registry. This behavior can lead to a significant increase in spam packages, undermining the integrity of the npm ecosystem and potentially affecting developers who rely on these packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tealove-nameka19If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can avoid using tealove-nameka19 and any other packages that are part of the tea.xyz token reward campaign. Regularly audit your project's dependencies to identify and remove any malicious packages.
Conclusion
The tealove-nameka19 package poses a significant threat due to its malicious code that modifies package metadata and floods the npm registry with spam. It is crucial for developers to remain vigilant, regularly audit their dependencies, and utilize tools like Vulert to monitor for vulnerabilities.
See every vulnerability recorded for tealove-nameka19 →
FAQ
tealove-nameka19 is an npm package involved in a malicious campaign to inflate developer reputation scores through spam package generation.
The vulnerability can lead to the pollution of the npm registry with spam packages, potentially affecting your project's dependency management and security.
You should remove the tealove-nameka19 package from your project immediately and audit your dependencies for any other malicious packages.
You can use tools like Vulert, which monitors your package-lock.json for open-source vulnerabilities in real-time. You can check your application against vulnerabilities using the Vulert playground without any signup.
Yes, tools like Vulert can help identify vulnerabilities in your dependencies by analyzing your package-lock.json file.
