MalwarePublished 10 Nov 2025

dewi-telur24-riris (npm) · Malicious Code

Affects dewi-telur24-ririsSource GCVE Database

Malicious package : remove dewi-telur24-riris and rotate any secrets on hosts that installed it.

Data as of 5 Nov 2026, 07:58 UTC

Classification

Malicious package

Published to npm · OSV MAL-2025-51537

What to do

Remove dewi-telur24-riris from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmdewi-telur24-riris	Affected–	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package dewi-telur24-riris contains malicious code linked to the tea.xyz token reward campaign. It is part of a large-scale spam operation flooding npm with over 15,000 packages in 2024. The malicious code includes autopublish scripts that automatically generate and publish derivative packages with randomized Indonesian-themed names. These scripts modify package.json files to remove private flags and alter version numbers, enabling continuous republishing of variants. The intent is to inflate developer reputation scores to gain rewards from the tea protocol token system, thereby polluting the npm registry.

Impact

The malicious code enables automated generation and republishing of numerous spam packages, which pollutes the npm registry and can degrade the quality and trustworthiness of packages available to developers. It manipulates developer reputation scores within the tea protocol token reward system, potentially leading to fraudulent reward claims. There is no indication of direct exploitation against end-user systems or data compromise from this package alone.

Defensive guidance

The best mitigation is to avoid using the dewi-telur24-riris package and other packages linked to the tea.xyz token reward campaign. Registry maintainers and security teams should monitor and remove such spam packages to preserve ecosystem integrity. Developers should verify package provenance before use and rely on trusted sources.

Summary

The dewi-telur24-riris npm package was identified by Amazon Inspector as containing malicious code associated with the tea.xyz token reward campaign. This campaign involves mass publication of spam packages designed to manipulate developer reputation scores by automatically generating and publishing derivative packages with randomized names. The malicious payload modifies package.json to remove private flags and changes version numbers, facilitating repeated republishing of variants. This activity results in significant pollution of the npm registry with spam packages, undermining the integrity of the ecosystem.

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Nov 2026, 07:58 UTC

Technical details

Community reviews