MalwarePublished 10 Nov 2025

patria-sroto45-sluey (npm) · Malicious Code

Affects patria-sroto45-slueySource GCVE Database

Malicious package : remove patria-sroto45-sluey and rotate any secrets on hosts that installed it.

Data as of 5 Nov 2026, 16:46 UTC

Classification

Malicious package

Published to npm · OSV MAL-2025-54184

What to do

Remove patria-sroto45-sluey from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmpatria-sroto45-sluey	Affected–	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The patria-sroto45-sluey npm package is part of a malicious campaign linked to the tea.xyz token reward system. It contains autopublish scripts that automatically generate and publish derivative packages with randomized Indonesian-themed names. The payload manipulates package.json files by removing private flags and altering version numbers to repeatedly republish variants, thereby polluting the npm registry and inflating developer reputation scores illegitimately.

Impact

The malicious payload enables continuous automated republishing of npm packages with randomized names, which pollutes the npm registry and can undermine trust in the ecosystem. It artificially inflates developer reputation scores within the tea.xyz token reward system, potentially misleading users and developers relying on package metadata and reputation. There is no direct evidence of exploitation in the wild or additional payloads beyond the registry pollution and reputation manipulation.

Defensive guidance

Users and maintainers should avoid installing or depending on packages related to the tea.xyz token reward campaign or those exhibiting autopublish scripts that modify package.json to remove private flags and republish automatically. Registry maintainers should consider removing or blocking such packages to prevent ecosystem pollution.

Summary

This threat involves the patria-sroto45-sluey npm package, which is associated with the tea.xyz token reward campaign that flooded the npm ecosystem. The package includes autopublish scripts (such as auto.js and autopublish.js variants) that automate the creation and publication of derivative packages with randomized names. These scripts modify package.json by removing private flags and changing version numbers to enable continuous republishing. The intent is to inflate developer reputation scores for the tea protocol token rewards and to pollute the npm registry with numerous malicious or spammy packages.

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Nov 2026, 16:46 UTC

Technical details

Community reviews