MAL-2025-112643 Malicious code in amazing_turkey_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 158e29ca6504ceb8678f8fdbdcb083e5f784b67aa9e4e8c355dbca553d5e9666 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in elderly_lark_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27f52dfa4d5f1872e2228caece1e5771ecf7c2c03a5d607ffc28cfc069354b12 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rifqi-ronde30-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 860b9f3d2a6467e18bf57d98ee9955c66ab478956f036f7525c4d93111d874c0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-118085 Malicious code in wibowo-mie83-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7c929dd0b319fd6cb0c78345d6766a7f5b7a06090a867c24e1993b67ca85aaa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in putri-sego26-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8565010e53c2142d1318ef16b5683768b044c5d4a28abc43c5e25343f9c20e9f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in better_fowl_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 964a0d5de77caf6bc3ca571f6d236c92bdd6ebbdcc9bece85bd00eaea281dec7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in statutory_scallop_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a1ba2c8440169121d2fce3fd83323ba6267be1f26c7b5395e0245a0ecff3013 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gita-lutis68-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04cb0aa696069c029e1e01e948099d9a64148cd76a89aeb6535aa8fd583292fa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-117583 Malicious code in udin-keripik96-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61a4aa0bb1a9afa8481638d540af2ad13146849bc6965de18b36b6ab0d5487e8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-115980 Malicious code in nana-tumis98-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66942c56e802fc421acb2c979b1bb6d44c04c8e5ce7eab9914b8b1e5107657aa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-114479 Malicious code in hadianto-moci26-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ff688aa66f9b21815bc1f2df11d7ef26fb84df76e8b60f4fc2cda50fe9800d8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-116297 Malicious code in old_clam_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a3459722abc016fb99ebc7bd1cd29769d45da3ba9072f7d6ea2c8490e2a9769 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-113198 Malicious code in comprehensive_smelt_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a98deada271ce0e229775ed6b86f54b363b56181b24da9e2c1fc7fd948df2f9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fadhil-mie25-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 662c5c0b431f9e0a3efa228380ce0d3fe8200c647e12001a54a0bf39152807cd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-112600 Malicious code in agus-lupis4-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f53ba08d649edc9c06aba3b7b522c32fe44320ce55b1d37bdd67684882de917 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-116149 Malicious code in ocha-naget69-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02d287499ee96ca9c454ae3f4b7b19dea81d16bb95a2de085f65d9d56dd41258 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

XPath Injection

smolagents is vulnerable to XPath injection. The vulnerability is due to insecure XPath construction due to searchitemctrlf concatenating unsanitized user input into XPath expressions, allowing attackers to inject XPath to bypass filters, access unintended DOM nodes, or disrupt web automation...

MAL-2025-111843 Malicious code in efficient_macaw_moccasin-85 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eab18adee367ca04e1198d92a2ef2a1b8318fb9b98cfea9385cf8856067df810 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in respective_salamander_amethyst-57 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4732193a365b795a76d14c67b280a999744de63cc15da083f3d9e2dc98972c77 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ideal_crocodile_blue-74 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbbe37fd8090781a3917f769fac7452ff529d0dad306029ac9cac0a7e5e407d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...