MAL-2025-184854 Malicious code in poliaz-ala-yulau (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e57e94da2c6e54c48acd27d7100a627424afd1180c2a92fa3504aac92aa5c551 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185186 Malicious code in sonic-oihg-moc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae2d948035fa9ba20a3da22db0b03896f246d346e715ce2144ac85d2dc01021b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-183992 Malicious code in mitok-doni-olodagil (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfd375c33c7a72566d8d8dd8b4ed8f46ccc84c604e1c9968f93c5586f5e10a5d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185271 Malicious code in tunis-kit-gahufaduufdi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 411089e96c4a176eb811222cc81bf740d2fd6392efeab2bdaa2ef899e16c3be3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-184043 Malicious code in mitoko-ontcami-lapikasi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 962969005951cb082def08faee126a0010e2039b8161d3bf02cd208bd13b5686 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185339 Malicious code in unise-kit-bogavotaawfi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3410b120e2ae4965125c564ee09b3d36062988c478d1de2bdffc4d4b7d4d1722 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in @akunsansan0/baong (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f507cbe1f75eabcfc98837682a818c498aeff00607d48da31f73d3d56f3f799b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

@akunsansan0/pucukharum (>=1.1.4, <=2.1.1), pucukharum (2.1.1) potentially affected by unknown CVE via pucukharum (1.1.4)

pucukharum NPM version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on pucukharum and may be impacted: - @akunsansan0/pucukharum =1.1.4, =2.1.1 - pucukharum 2.1.1 Source cves: unknown CVE Source advisory: OSV:MAL-2025-181514...

@akunsansan0/tea_gunt99 (1.1.4) potentially affected by unknown CVE via tea_gunt99 (1.1.2)

teagunt99 NPM version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on teagunt99 and may be impacted: - @akunsansan0/teagunt99 1.1.4 Source cves: unknown CVE Source advisory: OSV:MAL-2025-181569...

@akunsansan0/baso (1.0.0), @akunsansan0/biru (1.1.4) +284 more potentially affected by unknown CVE via tea_nextgun (>=1.1.7, <=2.1.1)

teanextgun NPM version =1.1.7, =2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on teanextgun and may be impacted: - @akunsansan0/baso 1.0.0 - @akunsansan0/biru 1.1.4 - @akunsansan0/biru1 1.1.4 - @akunsansan0/biru10 1.1.4 - @akunsansan0/biru11 1.1.4...

Malicious code in @akunsansan0/karedok19 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e5c94bd91327f8ea51df74b18c10ecb0240995f7856dbab481e8fb93daa35a9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

bako5 (1.1.4), tea_gun (>=1.1.2, <=1.1.3) potentially affected by unknown CVE via tea_gun (1.1.4)

teagun NPM version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on teagun and may be impacted: - bako5 1.1.4 - teagun =1.1.2, =1.1.3 Source cves: unknown CVE Source advisory: OSV:MAL-2025-181567...

Malicious code in roti41 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91216e5e002a1914b1fc895e621b3126b4e89c7d1b2b18de92381ea396af0544 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

tea_gunfinal (>=1.1.2, <=1.1.5) potentially affected by unknown CVE via tea_gunfinal (1.1.6)

teagunfinal NPM version 1.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on teagunfinal and may be impacted: - teagunfinal =1.1.2, =1.1.5 Source cves: unknown CVE Source advisory: OSV:MAL-2025-181568...

MAL-2025-181409 Malicious code in baso51 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cef24997c91d4a3575890eeccda0131184fe5bc0304fe29c4457e69671e950e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-181469 Malicious code in cewe16 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e70737668630f93820f229e54051acbeec29cc2c6927298206dc6739b12b06db This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-181536 Malicious code in roti29 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4081586b459393561fe22e1639a81652ad5f9d090bbe7efb31e27ad6070d6a4d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tea_guntry99 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7d6e491710d16f4f04edc61ffb1d3c214ef66787e862b981f9d9dd32a55964c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cewe20 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac56a9f36f3f95ba774129c441af79348a900781eac85d20f680cb3ad8e58b37 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in @akunsansan0/teagunz99 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1e18a5bbdb53c917f71debc48f150001f8a1c6a63a6373de4f96450e9326fc8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...