Malicious Code Injection in tealoveness7: A Threat to npm Users
Summary
MAL-2025-168800: Malicious code in tealoveness7 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package tealoveness7 is part of the tea.xyz token reward campaign that has infiltrated the npm ecosystem. It is designed to automate the generation and publication of derivative packages, often with randomized names, to inflate developer reputation scores in exchange for tea protocol token rewards. This behavior poses a significant risk to developers and users relying on npm packages.
Vulnerability Detail
The vulnerability in tealoveness7 stems from its malicious payload that modifies the package.json file by removing private flags and altering version numbers. It generates random package names, primarily themed around Indonesian culture, and continuously republishes these variants to pollute the npm registry. This can lead to a compromised development environment, where developers unknowingly integrate malicious code into their applications, potentially leading to data breaches or system compromises.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tealoveness7If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the tealoveness7 package and look for alternative packages that provide similar functionality without the associated risks. Always review the package's reputation and community feedback before integrating it into your project.
Conclusion
The tealoveness7 package poses a significant risk due to its malicious behavior, which can compromise the integrity of applications using it. Developers are advised to uninstall this package and monitor their projects for vulnerabilities using tools like Vulert. Staying informed and proactive is essential in maintaining a secure development environment.
See every vulnerability recorded for tealoveness7 →
FAQ
Tealoveness7 is an npm package that is part of a malicious campaign aimed at inflating developer reputation scores for token rewards.
The vulnerability can lead to the introduction of malicious code into your project, potentially compromising your application's security and integrity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
You should uninstall the package immediately using 'npm uninstall tealoveness7' and look for safer alternatives.
While specific alternatives depend on the functionality you need, always search for well-reviewed packages on npm that do not have a history of malicious behavior.
