MalwarePublished 12 Nov 2025

teate-thy-sonic-ahva (npm) · Malicious Code

Affects teate-thy-sonic-ahvaSource GCVE Database

Malicious package : remove teate-thy-sonic-ahva and rotate any secrets on hosts that installed it.

Data as of 12 Nov 2026, 21:18 UTC

Classification

Malicious package

Published to npm · OSV MAL-2025-180148

What to do

Remove teate-thy-sonic-ahva from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmteate-thy-sonic-ahva	Affected–	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'teate-thy-sonic-ahva' is part of a malicious campaign linked to the tea.xyz token reward system. It contains autopublish scripts that automatically generate and publish derivative packages with randomized names to artificially inflate developer reputation scores. The payload modifies package metadata to remove privacy flags, changes version numbers, and continuously republishes variants with Indonesian-themed or English names, polluting the npm registry.

Impact

The malicious package pollutes the npm registry with numerous derivative packages, potentially misleading developers and automated systems relying on package metadata. It artificially inflates developer reputation scores within the tea.xyz token reward ecosystem, undermining trust in the ecosystem's integrity. There is no indication of direct exploitation or compromise of user systems from this package, but it contributes to ecosystem pollution and potential supply chain confusion.

Defensive guidance

Users and maintainers should avoid installing or depending on packages associated with the tea.xyz token reward autopublish scripts. Registry maintainers should consider removing or blocking these packages to prevent ecosystem pollution. Monitoring for and removing derivative packages generated by this campaign is recommended.

Summary

This threat involves a malicious npm package that abuses the tea.xyz token reward campaign by using autopublish scripts (e.g., auto.js, autopublish.js) to automatically create and publish numerous derivative packages with randomized names. The malicious code alters package.json files by removing private flags and modifying version numbers to enable repeated publication. The campaign's goal is to inflate developer reputation scores fraudulently and flood the npm registry with these variants, which are named with Indonesian themes or English variants.

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 12 Nov 2026, 21:18 UTC

Technical details

Community reviews