MalwarePublished 10 Nov 2025

bayu-lapis34-sluey (npm) · Malicious Code

Affects bayu-lapis34-slueySource GCVE Database

Malicious package : remove bayu-lapis34-sluey and rotate any secrets on hosts that installed it.

Data as of 4 Nov 2026, 19:27 UTC

Classification

Malicious package

Published to npm · OSV MAL-2025-49865

What to do

Remove bayu-lapis34-sluey from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmbayu-lapis34-sluey	Affected–	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package bayu-lapis34-sluey was identified as containing malicious code linked to a large-scale spam campaign associated with the tea.xyz token reward system. This campaign involved over 15,000 spam packages in 2024 that use autopublish scripts to generate and publish derivative packages with randomized Indonesian-themed names. The malicious payload manipulates package metadata to remove privacy flags, alter version numbers, and continuously republish variants, thereby polluting the npm registry and inflating developer reputation scores illegitimately.

Impact

This malicious package pollutes the npm registry with numerous derivative packages, undermining the integrity of the package ecosystem. It artificially inflates developer reputation scores by exploiting the tea.xyz token reward system, potentially misleading users and automated systems that rely on reputation metrics. While no direct exploitation or system compromise is described, the registry pollution and reputation manipulation can degrade trust and complicate dependency management.

Defensive guidance

Users and maintainers should avoid installing or depending on the bayu-lapis34-sluey package and other related packages from the tea.xyz spam campaign. Registry maintainers and security teams should consider removing these malicious packages and monitoring for similar autopublish spam activity. Since this is a known malicious package, blocking or blacklisting it in dependency management tools is recommended.

Summary

The bayu-lapis34-sluey package is part of a widespread npm spam campaign tied to the tea.xyz token reward program. It contains autopublish scripts (e.g., auto.js, autopublish.js) that automatically create and publish derivative packages with randomized names. The malicious code modifies package.json files by removing private flags and changing version numbers to enable repeated publication. This behavior results in registry pollution and artificial inflation of developer reputation scores within the tea protocol ecosystem.

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 4 Nov 2026, 19:27 UTC

Technical details

Community reviews