Malicious Code Injection in tealove-poke40: A Threat to npm Users
Summary
MAL-2025-168667: Malicious code in tealove-poke40 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package tealove-poke40 is part of the tea.xyz token reward campaign, which has been known to flood the npm registry with malicious packages. These packages are designed to inflate developer reputation scores through the automatic generation and publication of derivative packages. The malicious nature of tealove-poke40 lies in its ability to modify essential files and continuously republish variants, thus polluting the npm ecosystem.
Vulnerability Detail
The vulnerability in tealove-poke40 originates from its design to include autopublish scripts that manipulate the package.json file. This manipulation removes private flags, alters version numbers, and generates random package names, leading to a significant risk of repository pollution. The continuous republishing of these variants can compromise the integrity of the npm registry and affect developers relying on legitimate packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tealove-poke40If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid using the tealove-poke40 package and monitor your project for any dependencies that may have been affected. You can also utilize tools like Vulert to scan your package-lock.json for vulnerabilities. For example, you can check your application using the Vulert playground at https://vulert.com/scanner without the need for signup.
Conclusion
The tealove-poke40 package poses a significant risk to npm users due to its malicious code designed to manipulate package files and pollute the npm registry. It is crucial to uninstall this package and monitor your project for vulnerabilities using tools like Vulert to ensure the integrity of your software.
See every vulnerability recorded for tealove-poke40 →
FAQ
Tealove-poke40 is an npm package that is part of a malicious campaign to inflate developer reputation scores through the automatic generation of derivative packages.
The vulnerability can lead to the pollution of the npm registry, potentially compromising the integrity of your project and making it difficult to manage dependencies.
You should uninstall the package immediately using 'npm uninstall tealove-poke40' and check for any dependencies that may have been affected.
Yes, you can use Vulert, which monitors your package-lock.json for open-source vulnerabilities in real-time. You can check your application at Vulert Scanner.
Currently, there is no patch available for tealove-poke40. It is recommended to remove the package and monitor for any updates from the maintainers.
