CLSA-2026-1792938613 TuxCare security update for gatsby-plugin-sharp (1 CVE)

TuxCare rebuilt gatsby-plugin-sharp to address 1 CVE. Fixed in 2.14.4-tuxcare.1...

CLSA-2026-1792689158 TuxCare security update for gatsby (1 CVE)

TuxCare rebuilt gatsby to address 1 CVE. Fixed in 2.32.13-tuxcare.1...

Malicious code in link-ora-gatsby-babel (npm)

Source: amazon-inspector ab2cbba5177f393474a7266a1fbf0f8ee23ba7cb420d9d2f5792a280484e1655 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in library-webdriverio-zephyr-gatsby (npm)

Source: amazon-inspector 9cb2806e454a3347d97bfec9ab573fcc2fba18838157b58f6c66978cb0b7d1b1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in koa-process-gatsby-stream (npm)

Source: amazon-inspector 798a18987a0275abf563f2f66f0c42262f0a090747f34fcd6f0305174adf9131 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in kaus-gatsby-mysql-eris (npm)

Source: amazon-inspector 3e5665518e65d519d977b2cc707a78c6be8ef6a5efb223966857feb2b01b5b68 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in karma-gatsby-virtualreality-concurrently (npm)

The package karma-gatsby-virtualreality-concurrently was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in karma-gatsby-nodejs-europa (npm)

The package karma-gatsby-nodejs-europa was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in json-figures-gatsby-standard (npm)

Source: amazon-inspector 00f0f17392b56d80f72cd5d178af7fead25d375c34ebf71364de580a8bc05822 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in json-gatsby-eslint-plugin-parcel (npm)

Source: amazon-inspector d71b7d24cfccff24043a5bf318d127b3dba80547a3c1e34d19ee6f55251614c8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in jasmine-gatsby-lint-meissa (npm)

Source: amazon-inspector 8459462649e24ea2121d663714ea09a44764f3c854c3983972a63b558327cefe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in janus-grunt-gatsby-lynx (npm)

Source: amazon-inspector a924f0426ddf06b8ef2466546109dd481e0454ec09d04bba7947208e692a7a4e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ignite-izar-hyperion-gatsby (npm)

Source: amazon-inspector 0894c7a3eb9e5f3c158e630bc71fbdb660de946d7d0a92955c82af30adb08ed4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hyperion-wezen-gatsby-elara (npm)

Source: amazon-inspector 9b9a5dacd1d551aa631da21bee30bcfa94538b09ab68a48ce915dbd65fad3a38 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hydra-gatsby-fomalhaut-sync (npm)

The package hydra-gatsby-fomalhaut-sync was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in halley-eigenstate-baryon-gatsby (npm)

Source: amazon-inspector d6305f8cb03ad275db307d48635591f959125243697c79edc5eba8a7fb0ab3ae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in graphql-gatsby-aquarius-phoebe (npm)

Source: amazon-inspector e14047635487fb6f2384b47629b34b22e9f878ee9d1fa29e1f9ddda750bf3122 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in event-hyperion-gatsby-sagitta (npm)

Source: amazon-inspector 92ce354f9451bace74524238b8c15adea7ad047426a0bf61a876cc44abdf5289 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eslint-gatsby-init-express (npm)

Source: amazon-inspector e2927981e2214a116cfa4d45c9f21260f04a036db99fe2eeedc2531cb6b09dc7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in enif-gatsby-fetch-lacerta (npm)

Source: amazon-inspector 0de2f9b8d363ef3c5fd440250303d6b6fd6a231b41e7b92f2ab5ae9881eaa924 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...