Malicious Code Injection in tealoveness5: A Threat to npm Users
Summary
MAL-2025-168778: Malicious code in tealoveness5 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
tealoveness5 is an npm package that is part of a broader campaign involving the tea.xyz token reward system. This package is designed to facilitate the generation and publication of derivative packages, often with randomized names, to manipulate developer reputation scores for token rewards. Its functionality is compromised by the presence of malicious scripts that can alter package metadata and republish variants, leading to potential security risks for users.
Vulnerability Detail
The vulnerability in tealoveness5 originates from its association with a malicious campaign that floods the npm registry with derivative packages. The malicious payload modifies the package.json file by removing private flags, altering version numbers, and generating random package names. This behavior not only pollutes the npm registry but also poses a risk of unintentional dependency inclusion for developers, potentially leading to further exploitation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tealoveness5If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the installation of tealoveness5 by adding it to your project's .npmrc file with the following line: 'package-lock=false'. This will help avoid any unintended installations of this malicious package.
Conclusion
The tealoveness5 package poses a significant security risk due to its malicious code designed to manipulate npm registry data. It is crucial for developers to be vigilant about the packages they use and to take immediate action to remove any affected packages. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for tealoveness5 →
FAQ
tealoveness5 is an npm package that is part of a malicious campaign aimed at manipulating developer reputation scores through the publication of derivative packages.
The vulnerability can lead to the inclusion of malicious code in your project, potentially compromising its security and integrity.
You should uninstall the package immediately using 'npm uninstall tealoveness5' and review your project's dependencies for any other potentially malicious packages.
You can use tools like Vulert, which monitors your package-lock.json for open-source vulnerabilities in real-time. You can check your application for vulnerabilities using the Vulert playground at Vulert Scanner without any signup.
Regularly audit your dependencies, use trusted sources for packages, and consider implementing automated tools to monitor for vulnerabilities.
