MalwarePublished 10 Nov 2025

sari-sate15-riris (npm) · Malicious Code

Affects sari-sate15-ririsSource GCVE Database

Malicious package : remove sari-sate15-riris and rotate any secrets on hosts that installed it.

Data as of 6 Nov 2026, 19:13 UTC

Classification

Malicious package

Published to npm · OSV MAL-2025-54823

What to do

Remove sari-sate15-riris from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmsari-sate15-riris	Affected–	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'sari-sate15-riris' is part of a malicious campaign linked to the tea.xyz token reward scheme. It contains autopublish scripts that automatically generate and publish numerous derivative packages with randomized Indonesian-themed names. The payload modifies package.json files to remove private flags and increment version numbers, enabling continuous republishing of variants. This activity pollutes the npm registry and artificially inflates developer reputation scores within the tea protocol token ecosystem.

Impact

This malicious package does not directly exploit a software vulnerability but abuses the npm package publishing system to flood the registry with numerous derivative packages. This can degrade the quality and trustworthiness of the npm ecosystem and distort developer reputation scores used by the tea.xyz token reward campaign. There is no indication of direct code execution or data compromise from this package alone.

Defensive guidance

Users and maintainers should avoid installing or depending on packages related to this campaign. Registry maintainers should consider removing or blocking these autopublished packages to preserve ecosystem integrity.

Summary

The 'sari-sate15-riris' npm package is involved in a token reward abuse campaign associated with tea.xyz. It uses autopublish scripts (such as auto.js and autopublish.js variants) to automatically create and publish derivative packages with randomized names. The malicious code alters package.json by removing private flags and changing version numbers to facilitate repeated publication of new variants. This behavior results in registry pollution and manipulation of developer reputation metrics tied to the tea protocol token rewards.

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 19:13 UTC

Technical details

Community reviews