EUVD-2025-180308

Malicious code in asteroid-winston-eclipse-hugo npm...

MAL-2025-189134 Malicious code in regulus-node-sass-hugo-mensa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7720784fc00aa2f848cde571bf6f8b13377cb1eaefc406673aa08a433b686103 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188373 Malicious code in nuxtjs-hugo-karma-antares (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79556a4b1006c3aa3f897ef9fccba95b8e8d674b5863c91df3f26f4e762b507a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-178496

Malicious code in hugo-nashira-boson-passport npm...

Malicious code in proxima-hugo-pm2-phoebe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bb17e16f79c8aed56179cb32c277f170ac4625f582251cd9e83a240a0d374c6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hugo-capella-janus-nucleosynthesis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c833040778b208833172be98968dc0d98c708a39a399c3fdd27d8c86303fb62 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-176855

Malicious code in quark-hugo-geckodriver-ionosphere npm...

EUVD-2025-178000

Malicious code in luna-zephyr-hugo-fusion npm...

EUVD-2025-178498

Malicious code in hugo-mini-css-extract-plugin-ophiuchus-convict npm...

EUVD-2025-178344

Malicious code in iota-hugo-mongoose-hapi npm...

Malicious code in hugo-build-configstore-rollup-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9153c124f5d5e6316c12ad12d229ee3d86fb12c8b46821aa50e1b4c2d6c78a2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-178404

Malicious code in init-parcel-run-script-hugo npm...

Malicious code in hugo-plutology-comet-cluster (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector efae6173e3dbad8733385d1fb7c202c31c5a07b0f351bc94b93fb683565134e2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187389 Malicious code in hugo-wavefunction-dotenv-parse-variables-parallax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ecf14a07cd348f4aef4bf71dd063f333aee890c7b9fffa4af049cac1d997ef9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-179460

Malicious code in css-minimizer-webpack-plugin-hugo-gemini-command npm...

MAL-2025-187382 Malicious code in hugo-build-configstore-rollup-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9153c124f5d5e6316c12ad12d229ee3d86fb12c8b46821aa50e1b4c2d6c78a2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187386 Malicious code in hugo-nashira-boson-passport (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 728679d568943b8e701a38466dcaf011a95064ea258b5e16ed806bdee8ef90f4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-112707

Malicious code in hugo-toml-blitz-dotenv npm...

EUVD-2025-121532

Malicious code in supervisor-koa-carpo-hugo npm...

Malicious code in gridsome-auriga-hugo-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5400b01f0a228464c1b8d83ed4a3fbf00d7d6e8f83f717883a54a3e3fc49282c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...