Malicious Code Injection in terrible_ladybug-appteadev Package
Summary
MAL-2025-109555: Malicious code in terrible_ladybug-appteadev (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The terrible_ladybug-appteadev package is part of the npm ecosystem, typically used for various development tasks. However, it has been identified as part of a malicious campaign aimed at manipulating the npm registry. This package is associated with the tea.xyz token reward initiative, which has been known to flood the npm registry with derivative packages that inflate developer reputation scores.
Vulnerability Detail
The vulnerability in the terrible_ladybug-appteadev package stems from its malicious code that modifies the package.json file. This code removes private flags, alters version numbers, and generates random package names, leading to the continuous republishing of these variants. The origin of this issue is linked to a broader campaign that exploits npm's publishing mechanisms, potentially polluting the registry and affecting developers' reputations.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall terrible_ladybug-appteadevIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the package from being used in your project by removing it from your dependencies and ensuring that your package-lock.json file does not include it. Additionally, you can monitor your dependencies using tools like Vulert, which can alert you to vulnerabilities in real-time.
Conclusion
The terrible_ladybug-appteadev package poses a significant risk due to its malicious code that alters package metadata and floods the npm registry. It is crucial for developers to remove this package from their projects and utilize tools like Vulert to monitor for vulnerabilities in real-time.
See every vulnerability recorded for terrible_ladybug-appteadev →
FAQ
It is an npm package that has been identified as part of a malicious campaign to manipulate the npm registry.
The vulnerability can lead to the pollution of the npm registry and may affect your project's reputation and integrity.
You should uninstall the package immediately and monitor your project for any further vulnerabilities.
Yes, regularly monitor your dependencies using tools like Vulert, which can alert you to open-source vulnerabilities in real-time.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
