Malicious Code Injection in tzgxrf-devapptea Package: A Threat to npm Users
Summary
MAL-2025-109906: Malicious code in tzgxrf-devapptea (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tzgxrf-devapptea package is part of the tea.xyz token reward campaign, which has been known to flood the npm registry with malicious packages. These packages are designed to inflate developer reputation scores through automated scripts that generate and publish derivative packages with randomized names. The presence of such malicious code poses a significant risk to developers and users relying on npm packages for their applications.
Vulnerability Detail
The vulnerability in the tzgxrf-devapptea package originates from its malicious design, which includes autopublish scripts that modify the package.json file to remove private flags, change version numbers, and generate random package names. This behavior leads to the continuous republishing of variants, polluting the npm registry and potentially compromising other packages. The ramifications include loss of trust in the npm ecosystem, potential data breaches, and the risk of integrating compromised packages into applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall tzgxrf-devappteaIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can manually check your package-lock.json file for any references to tzgxrf-devapptea and remove it. Use the following command to uninstall the package: npm uninstall tzgxrf-devapptea.
Conclusion
The tzgxrf-devapptea package poses a significant threat to npm users due to its malicious code designed to manipulate package data and flood the registry. Immediate action is required to remove this package and safeguard your applications from potential risks.
See every vulnerability recorded for tzgxrf-devapptea →
FAQ
The tzgxrf-devapptea package is part of a malicious campaign that generates and publishes derivative npm packages to inflate developer reputation scores.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
It is recommended to uninstall the tzgxrf-devapptea package immediately to prevent any potential risks associated with its malicious code.
Yes, using this package can lead to the pollution of the npm registry, loss of trust in the ecosystem, and potential data breaches.
Currently, there is no patched version available. The best course of action is to remove the package from your project.
