MAL-2025-187679 Malicious code in kernel-visualize-meta-import-transpile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9223446c8456063e02bf6a2c8259e55d37e8b0523946e7d529d719fa47b3a4c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189039 Malicious code in query-betelgeuse-nebula-dotenv-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 408daa89c70619dc90c25827b6f89e118cc4f1450ae3a3b7e834585362c6c839 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188261 Malicious code in new-user-static-awk-zeta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9f9dcf7eed16e352a4e0fcdb4e1c39ec368864e56f59a7c610fef54ab9b66cb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188882 Malicious code in protected-cat-mu-file-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0ad50d17aa268315c0b7f98ea661a6506e5a7318ca7cce5dbecab5d55514a17 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189933 Malicious code in thuban-run-script-octans-eslint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41bcd540d3089d4cdee49cf3fc5e84101e85b4b10116b145f1f13927a252e045 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-190422 Malicious code in yaml-cache-sails-jwt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af495e448a44b27ba05a7124ae72a767dbc8c0ee4b614c3f1fe4155da6a49a1e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188740 Malicious code in planetology-virgo-archaeometry-envconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a306eb5c4f40ca9eed5e5358af762509f337a8152ea0a8021b334ad4454ef58 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186960 Malicious code in fetch-ursa-vega-grus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0d636c0752eaa2b5ba9b87b8801329c119b834f1e4a4d5790878fed205c0a6a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186999 Malicious code in float-beta-deploy-star-meta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c28ea191cc624187c918a5e511152ef7fdd4e559f69dd061a432e823a1547cb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186381 Malicious code in cross-env-dorado-eslint-config-zephyr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0985a4ef455f65277df5cbe81f64d7157822a1f417ec13d808b81967e4ce8e28 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-46917

Name of the Vulnerable Software and Affected Versions grist-core versions prior to 1.7.7 Description grist-core is a spreadsheet hosting server. A user with limited read access to a document could access endpoints that reveal hashes for different versions of the document and obtain a complete lis...

Malicious code in mitali-don-olikiakbuamua (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a53af0bec88534ce6d812d57f3aeb76ef733d5c7584f5adef8f0693c895aea73 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in itale-adci-gggbu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32111508e1795c7bad7c21bb710c7161d7d5e07291af62984555c76bb4c8b75a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mitok-doni-oldis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 108fe741ad7c7087330710c10bb807812cdf241ddfd5847226061ff233662a26 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in liobc-ug-afayafuycig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b0a6acdacd00e92ac314d37f5f4767ad48afbc0d5b961565bdb68c7cf4c5ae2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in imodiov-kufi-cocaki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48d857b8b6d5145d9b7a5908bac252ff27c023cbdbedd5b8e5e27ca1493616ba This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in itale-dci-fngduyge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49ae4ee65de2da1a72f4a9ecae4393c1589abc667c295e355c67940d3242da6e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in libc-ug-atafiag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cbf5de018164a3e9c96eb8f51d62e077b58e66f5f2808895056c3224ad8cd85 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-os-afsigafoa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 167ba2603e47d42800c574076f405bc601a59b7377615b051a0c3f4169af99fd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in itale-dci-rshayt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d67f9aee887cf6bb9f546f0445f1c7cd84d4f2bf8577db5ba7fd81005890fc98 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...