Malicious Code Injection in thirsty_cockroach-teagooddev: npm Package Vulnerability
Summary
MAL-2025-109612: Malicious code in thirsty_cockroach-teagooddev (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'thirsty_cockroach-teagooddev' is part of the tea.xyz token reward campaign, which has been associated with a series of malicious npm packages. These packages are designed to inflate developer reputation scores by automatically generating and publishing derivative packages with randomized names. The malicious nature of this package lies in its ability to modify critical files and republish variants, thereby polluting the npm registry.
Vulnerability Detail
This vulnerability originates from the package's design to include autopublish scripts that manipulate the package.json file. The malicious payload removes private flags, alters version numbers, and generates random package names, which can lead to a significant increase in spammy packages within the npm ecosystem. This not only affects the integrity of the npm registry but also poses risks to developers who may unknowingly install these compromised packages.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall thirsty_cockroach-teagooddevIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, avoid using the 'thirsty_cockroach-teagooddev' package and consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The 'thirsty_cockroach-teagooddev' package poses a significant risk due to its malicious code designed to manipulate npm registry integrity. It is crucial for developers to take immediate action by removing this package and utilizing tools like Vulert to safeguard their projects against similar vulnerabilities.
See every vulnerability recorded for thirsty_cockroach-teagooddev →
FAQ
The vulnerability can lead to the proliferation of spammy packages in the npm registry, affecting the integrity of the ecosystem and potentially compromising other projects.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By simply analyzing your package-lock.json file, Vulert provides real-time alerts for vulnerabilities.
Regularly audit your dependencies and utilize tools like Vulert to monitor for vulnerabilities. Keeping your packages updated and avoiding unverified packages can also help.
Immediately uninstall the 'thirsty_cockroach-teagooddev' package and check your project for any other potentially compromised packages.
Detailed information can be found in the vulnerability report on the official GitHub repository and through security advisories related to npm packages.
