Malicious Code Injection in Technological Wombat Emerald-31: npm Package Vulnerability
Summary
MAL-2025-109531: Malicious code in technological_wombat_emerald-31 (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Technological Wombat Emerald-31 is an npm package that is part of the tea.xyz token reward campaign. It is designed to facilitate the generation and publication of derivative packages. However, this package has been compromised, leading to the introduction of malicious scripts that manipulate package metadata and flood the npm registry with spammy variants.
Vulnerability Detail
The vulnerability originates from the package's involvement in a token reward scheme that exploits npm's publishing capabilities. Malicious scripts within the package modify the package.json file to remove private flags, alter version numbers, and create random package names, ultimately leading to the pollution of the npm registry. This can severely impact developers by inflating reputation scores fraudulently and potentially introducing security risks through unverified packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall technological_wombat_emerald-31If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the installation of this package by using npm's package-lock.json to lock your dependencies. Additionally, you can monitor your project for vulnerabilities using Vulert, which analyzes your package-lock.json file to alert you of any open-source vulnerabilities in real-time.
Conclusion
The Technological Wombat Emerald-31 npm package has been identified as containing malicious code that can compromise your project's security. It is crucial to take immediate action by updating or removing the package and monitoring your dependencies for vulnerabilities using tools like Vulert.
See every vulnerability recorded for technological_wombat_emerald-31 →
FAQ
It is an npm package involved in the tea.xyz token reward campaign, designed to generate and publish derivative packages.
The vulnerability can lead to the introduction of malicious code, which may compromise your project's integrity and security.
Signs include unexpected changes in your package.json file, the presence of numerous random package names, and potential performance issues due to spammy packages.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If no patched version is available, consider removing the package from your project and replacing it with a secure alternative.
