EUVD-2025-114900

Malicious code in cosmos-metalsmith-lint-staged-tethys npm...

EUVD-2025-124267

Malicious code in nova-cli-cosmos-phoebe npm...

Malicious code in cosmos-blitz-got-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3cab308e3dfecb0e0f1d7e5a6ac6a093767de259085409cb5e48b1f410f5560 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in virgo-quasar-orbit-cosmos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e18a6e8300a181852e113ff2fc98e322083e63a46937effefc962720baaa0258 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-120198

Malicious code in xml-phoebe-cosmos-sadr npm...

EUVD-2025-123471

Malicious code in postgres-webdriver-manager-cosmos-slidev npm...

EUVD-2025-115581

Malicious code in centauri-cosmos-sirius-soap npm...

EUVD-2025-113847

Malicious code in europa-dactyl-cosmos-subscription npm...

Malicious code in sails-cosmos-run-script-envconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce4dcef092d4e4e3992f67dde330353e4a21f4715c8c58e5e8e6fee3efcb84f3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in airbnb-module-winston-cosmos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acb5ec25abac37225c8be7b23ea2da3a0519e6735cddc384929b39303ffc3671 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-116789

Malicious code in algol-vega-cosmos-sagitta npm...

Malicious code in ignite-private-cosmos-nuxtjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2641d8590183b42285b0d38cbd94317dc3626768661335897e9cb724db6daeba This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-123230

Malicious code in protractor-optimize-css-assets-webpack-plugin-rest-cosmos npm...

EUVD-2025-115272

Malicious code in cluster-sync-development-cosmos npm...

EUVD-2025-116170

Malicious code in bellatrix-cosmos-pulsar-foundation npm...

MAL-2025-145996 Malicious code in pavo-dotenv-safe-cosmos-cordelia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 716d370389a73f5f2d8bb1d652817fcd01c99cb04fdd4add1575b54b2c1d2d61 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147356 Malicious code in rest-mongoose-cosmos-centaurus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ec8c395f1c5373c254a1210bf0c7c699cfbc6a52c5a2a81f59fb1803c47f469 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144578 Malicious code in luna-phoebe-despina-cosmos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ecff078b7d6ee9dbb72b33f4db4f7635fa8887e98b1db63f8fcaab39c219a81 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141219 Malicious code in cosmos-selenium-sequelize-ultra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f4485133c273d06fc23d91992ef2557ab94d5613ddfed85fe9ea48165e46b94 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141207 Malicious code in cosmos-helmet-grus-cross-env (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c0832fade9a9296d4f2dfcbccf8d7199ad9b8487cba5e1383233e5c5b44abeb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...