EUVD-2025-111480

Malicious code in magellan-fork-colors-fomalhaut npm...

EUVD-2025-111257

Malicious code in mensa-pm2-enceladus-fork npm...

EUVD-2025-112625

Malicious code in hyperion-materialize-nodemon-fork npm...

EUVD-2025-112549

Malicious code in indus-fork-rimraf-forever npm...

EUVD-2025-112157

Malicious code in jovian-pegasus-fork-figures npm...

Malicious code in airbnb-fork-mutation-fusion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 793b36b14fb2abf3bdaac4f697b01eff9656ab057f26f8af0397d78ec7130074 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bulma-remark-fork-equinox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d37912dda2c1fc048a26c13f8571365845e50058fd84f42956b4a136617b0975 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in convict-fork-pyxis-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5812c5fca60d1dc97f84b0717487cf140262af29cecb3162e85e2553eadcf919 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in farout-nightmare-superagent-fork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f20270a1be781484d6ac981fddbb01a36fb6292d347aac034ab283733ddc5dec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fork-csv-standard-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 207804b34c80b70376e5579f1c9e4b7c425db63c480b78e030d71008f1416272 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fork-foundation-enceladus-avior (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47f8401d11f4b6874b1999bdf3f2ec8220a510a0e127d7d11a1535ebc1f3395e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fork-less-loader-stream-spinner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65f983e20b23c6c3ea63bfec0d0eb328ca07ecf008967e2c5e765651916732d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fork-writable-miranda-dorado (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa2c06e94df0ee3bbe0de2fafb23ce4891a4357d3007dc2d8241ab688d448ba3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fornax-metalsmith-fork-hydra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11e5b8e68461ff828257fd3b73d19f935cbd1d9b9033b8aea6b327f49d220c42 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gatsby-fork-soap-promise (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b73e7a65de6af65020a1c45f76329317657d4f7569beaffbfa56f0471cd8adbc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jovian-pegasus-fork-figures (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b69d19a2d6e02cc5e034b684051a6916cd908bb4104d27c1e3137f97d1def607 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in postcss-loader-fork-levels-venus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6eeb87c440bcb3eff380092f73c31bd01232d896ff500023793df85c072d0644 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in release-it-sass-loader-parcel-fork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c5b769cb83d4424c30fd9e0d87d8ae149c3c2188ae87c28d2c06b4ec5c28b15 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rollup-plugin-yonder-draco-fork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 882dd9b292283f0e6f159f85b76503f46a224aac7d185a399da12e6e783d5865 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sirius-fork-nodejs-bellatrix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c6c1bd831399d8c2b516a325a12d79cba13a091a76042525b7e1c1c6feb29e9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...