MalwarePublished 12 Nov 2025

teate-thy-py-nahsuk (npm) · Malicious Code

Affects teate-thy-py-nahsukSource GCVE Database

Malicious package : remove teate-thy-py-nahsuk and rotate any secrets on hosts that installed it.

Data as of 12 Nov 2026, 21:12 UTC

Classification

Malicious package

Published to npm · OSV MAL-2025-180082

What to do

Remove teate-thy-py-nahsuk from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmteate-thy-py-nahsuk	Affected–	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The teate-thy-py-nahsuk npm package is part of a malicious campaign linked to the tea.xyz token reward system. It contains autopublish scripts that automatically generate and publish numerous derivative packages with randomized names, aiming to inflate developer reputation scores. The malicious payload modifies package.json files by removing private flags, altering version numbers, and generating random Indonesian-themed or English package names. This behavior results in continuous republishing of variants, causing pollution of the npm registry.

Impact

The malicious package causes pollution of the npm registry by continuously publishing numerous derivative packages with randomized names. This can degrade the quality and trustworthiness of the npm ecosystem, potentially misleading developers and automated systems that rely on package metadata and reputation scores. While no direct exploitation or compromise of user systems is described, the manipulation of package metadata and flooding of the registry can disrupt normal package management and trust.

Defensive guidance

Mitigation involves avoiding installation or use of the teate-thy-py-nahsuk package and any derivative packages generated by this campaign. Developers and organizations should monitor for suspicious packages exhibiting autopublish behavior and remove or block such packages from their dependency trees. Registry maintainers should consider removing or flagging these packages to prevent further pollution.

Summary

This threat involves the teate-thy-py-nahsuk npm package, which is used in a token reward campaign flooding the npm registry. The package includes autopublish scripts (auto.js, autopublish.js, autopublish2.js, autopublish3.js) that automate the creation and publication of derivative packages with randomized names. The malicious code modifies package.json files to remove private flags and change version numbers, enabling continuous republishing of these variants. The campaign's goal is to artificially inflate developer reputation scores for the tea protocol token rewards, leading to registry pollution and potential trust issues within the npm ecosystem.

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Nov 2026, 21:12 UTC

Technical details

Community reviews