Malicious Code Injection in Valuable Stingray Package - npm Vulnerability
Summary
MAL-2025-110333: Malicious code in valuable_stingray-teagooddev (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'valuable_stingray-teagooddev' package is part of the tea.xyz token reward campaign, which has been known to flood the npm registry with malicious packages. These packages are designed to inflate developer reputation scores through the automatic generation and publication of derivative packages. The functionality of this package is compromised due to its malicious intent, which includes modifying package.json files and republishing variants to pollute the npm registry.
Vulnerability Detail
The vulnerability originates from the package being part of a malicious campaign that utilizes autopublish scripts to generate and publish numerous derivative packages with randomized names. This behavior not only modifies the package.json to remove private flags and change version numbers but also continuously republishes these variants, leading to potential security risks and pollution of the npm registry. The malicious payload can affect developers by compromising their reputation and potentially introducing security flaws into their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall valuable_stingray-teagooddevIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can remove the package from your dependencies by running the command: npm uninstall valuable_stingray-teagooddev. This will prevent any malicious code from executing in your application.
Conclusion
The 'valuable_stingray-teagooddev' package poses significant risks due to its malicious code designed to manipulate npm registry entries. It is crucial for developers to remove this package and monitor their dependencies to safeguard their applications from potential threats.
See every vulnerability recorded for valuable_stingray-teagooddev →
FAQ
The package contains malicious code that modifies package.json files and floods the npm registry with derivative packages.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check your application without any signup.
It is advisable to uninstall the package immediately and check for any other dependencies that may be affected.
Yes, using this package can lead to reputation damage for developers and potential security vulnerabilities in applications.
Regularly monitor your dependencies using tools like Vulert and stay updated on known vulnerabilities in the npm ecosystem.
