Malicious Code Injection in tehah-kali-bauta Package - npm Vulnerability
Summary
MAL-2025-168955: Malicious code in tehah-kali-bauta (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The tehah-kali-bauta package is part of the npm ecosystem, which is widely used for JavaScript package management. This package is associated with the tea.xyz token reward campaign, which has been known to flood the npm registry with malicious packages. The primary functionality of this package is to serve as a token reward mechanism, but it has been compromised to include harmful scripts that manipulate package metadata.
Vulnerability Detail
The vulnerability in tehah-kali-bauta originates from its association with a malicious campaign that aims to inflate developer reputation scores through the automatic generation and publication of derivative packages. The malicious payload alters the package.json file by removing private flags, changing version numbers, and creating random package names. This behavior not only pollutes the npm registry but also poses significant risks to developers who may unknowingly use these compromised packages, leading to potential security breaches in their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tehah-kali-bautaIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the tehah-kali-bauta package and any other packages associated with the tea.xyz token reward campaign. Additionally, you can monitor your package-lock.json file for any unauthorized changes using tools like Vulert, which can alert you in real-time for open-source vulnerabilities.
Conclusion
The tehah-kali-bauta package has been identified as a vector for malicious code injection, posing significant risks to developers and their applications. It is crucial to stay informed about such vulnerabilities and take proactive measures to secure your projects.
See every vulnerability recorded for tehah-kali-bauta →
FAQ
Tehah-kali-bauta is an npm package associated with a token reward campaign that has been compromised to include malicious scripts.
The vulnerability can lead to unauthorized modifications in your package.json file, potentially compromising your application's integrity and security.
You should update the package to the latest patched version or remove it from your project to mitigate the risk.
You can use Vulert to monitor your package-lock.json file for vulnerabilities without needing to access the code or install additional software.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
