Malicious Code Injection in tealove-nanami45: A Threat to npm Packages
Summary
MAL-2025-168475: Malicious code in tealove-nanami45 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package tealove-nanami45 is part of the tea.xyz token reward campaign that has infiltrated the npm ecosystem. It is designed to manipulate developer reputation scores by automatically generating and publishing derivative packages with randomized names. This behavior not only clutters the npm registry but also poses a significant risk to developers who may unknowingly integrate these malicious packages into their projects.
Vulnerability Detail
The vulnerability in tealove-nanami45 originates from its inclusion in a malicious campaign aimed at inflating developer reputation scores for token rewards. The package contains scripts that modify the package.json file to remove private flags, alter version numbers, and generate random package names, leading to continuous republishing of these variants. This behavior can compromise the integrity of the npm registry and expose developers to potential security risks, as they may inadvertently use these malicious packages in their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tealove-nanami45If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the tealove-nanami45 package and instead rely on verified alternatives. Regularly audit your package-lock.json file to identify and remove any potentially harmful packages.
Conclusion
The tealove-nanami45 package poses a significant risk due to its malicious behavior aimed at inflating developer reputation scores. It is crucial to remove this package from your projects and regularly audit your dependencies to maintain the security and integrity of your applications.
See every vulnerability recorded for tealove-nanami45 →
FAQ
Tealove-nanami45 is an npm package that is part of a malicious campaign aimed at manipulating developer reputation scores for token rewards.
The vulnerability can lead to the integration of malicious code into your project, potentially compromising its security and integrity.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software by analyzing your package-lock.json file.
You should uninstall the tealove-nanami45 package immediately and review your dependencies for any other potentially harmful packages.
Regularly audit your dependencies, use trusted packages, and monitor your projects for vulnerabilities using tools like Vulert.
