EUVD-2025-120302

Malicious code in xanthus-koa-cross-env-webdriver-mocha npm...

EUVD-2025-122378

Malicious code in run-script-got-cross-env-yaml npm...

Malicious code in cross-env-init-sedna-telesto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e729a7f1b0789e7b94d947b7ba5acb27a8acd7ae8ba2fa26a5ab8cebd8b37ceb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-113489

Malicious code in fornax-gulp-cross-env-miranda npm...

EUVD-2025-111209

Malicious code in meteor-cross-env-promise-comet npm...

EUVD-2025-114057

Malicious code in enif-meteor-protractor-cross-env npm...

EUVD-2025-114842

Malicious code in cross-env-request-markdown-magellan npm...

EUVD-2025-120386

Malicious code in wolf-cross-env-markdown-postcss-loader npm...

EUVD-2025-112698

Malicious code in husky-cross-env-miranda-eclipse npm...

EUVD-2025-112286

Malicious code in janus-prettier-stylelint-cross-env-server npm...

Malicious code in pino-cross-env-jasmine-json (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ec70413487935d3604fad3ffe3220304ef0fe67e010a5e0e0bb3f32e2fa28b5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-121908

Malicious code in soap-cross-env-norma-subscription npm...

Malicious code in cross-env-semantic-ui-dependencies-europa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6332d430064a3f2838ee485b692085966c87a656a847987e105921afff07be4d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-114843

Malicious code in cross-env-quantum-nightwatch-bunyan npm...

MAL-2025-141273 Malicious code in cross-env-soap-winston-fomalhaut (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20c093cbd1ca03d9684a17411c5b102b2d7045783909788e47ba39b5fbfcccb3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141272 Malicious code in cross-env-semantic-ui-dependencies-europa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6332d430064a3f2838ee485b692085966c87a656a847987e105921afff07be4d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141265 Malicious code in cross-env-prompts-equinox-mdx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4705e7db14495cadbb89c51f3f8daee6b48ff5007a23ac673f16535a49b7849d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141264 Malicious code in cross-env-pegasus-async-ganymede (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68a6a5d9de5d3e6171d01a2b039e57bcc853f57222af8a5c94eaf0f922621903 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146970 Malicious code in query-lint-dione-cross-env (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9cce3fbcf9f2f080f5429ac6cdfde30ab50eab69ed68d84c2d663dae5bbb661 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140669 Malicious code in changelog-eris-apollo-cross-env (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 049d96747335ea7770993eb1f70fc96a4667abd33a8f58524be01f2c0992446b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...