Malicious Code Injection in tealove-nice47: npm Package Vulnerability
Summary
MAL-2025-168527: Malicious code in tealove-nice47 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package tealove-nice47 is part of a broader campaign associated with the tea.xyz token reward system, which has been flooding the npm ecosystem. This package is designed to manipulate npm's publishing system, generating derivative packages with randomized names to inflate developer reputation scores for token rewards. Its functionality is primarily centered around automatic publishing, which poses significant risks to the integrity of the npm registry.
Vulnerability Detail
The vulnerability in tealove-nice47 originates from its malicious code that modifies the package.json file to remove private flags and alters version numbers. It generates random package names, primarily themed around Indonesian culture, and continuously republishes these variants. This behavior not only pollutes the npm registry but also compromises the security and reliability of the packages within the ecosystem, potentially leading to further exploitation by malicious actors.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tealove-nice47If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the tealove-nice47 package and any other packages associated with the tea.xyz token reward campaign. Regularly audit your npm packages to ensure no malicious packages are present.
Conclusion
The tealove-nice47 package poses a significant risk due to its malicious code that modifies package metadata and floods the npm registry with derivative packages. It is crucial for developers to remove this package and monitor their dependencies to maintain the integrity of their projects.
See every vulnerability recorded for tealove-nice47 →
FAQ
Tealove-nice47 is an npm package that is part of a malicious campaign aimed at inflating developer reputation scores through automated publishing of derivative packages.
The vulnerability can lead to the pollution of the npm registry, potentially introducing malicious code into your project and compromising its security.
You should uninstall the package immediately using 'npm uninstall tealove-nice47' and audit your project for any other malicious dependencies.
You can use tools like Vulert, which monitors your package-lock.json for vulnerabilities in real-time. You can check your application against known vulnerabilities using the Vulert playground without any signup.
Regularly audit your dependencies, use tools like Vulert for monitoring, and stay informed about the latest security advisories in the npm ecosystem.
