Malicious code in avminh-afs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 018d15fbf9a482a2e882124e01c25af3e57fbe5dce6995b5dfa0c2a919893e6a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in samehadaku-tuzss-sur7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2049849e714cb872c2646d8a414b7611ec8124d3ad4b9fa1b23e07cbe1b560b4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in abang-poke49 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 265a3ba2a926350281bcfac9015ae95f6d67c9788f16ba49a0b6fd8e413bf6c9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rival-poke29 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b1e4cfd0174d5252cf79fec5061077b2d20c7a117cde59de86de734a86238a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

siddheshtea (1.1.6) potentially affected by unknown CVE via nudela-rahfeg-hahgsa (1.0.0)

nudela-rahfeg-hahgsa NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on nudela-rahfeg-hahgsa and may be impacted: - siddheshtea 1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-163839...

Malicious code in verify-ayai-augial (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47651a63b29d5c6a354ea42775d42d21c41e5732f0e491507176f58783994dd8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in messi-tueda-sddsf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0fa41543d3c39ee6251b396876a1acd0b9b85a12c21f4b7371f02657d9af879 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in anaisisl-pafi-asia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84928420e611c43189eef44db388e0d68430c352a62d6693c4182d3a7e6b4461 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in manaf-assssin-muanst (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd820a46e6ab146a004d83418c9f5d93bf372279b318b5a9515cde0452ec455e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in @mipta1/husada (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07b109c651e524c5b105d85798f362d052e5604037f9a592ede2beba8f979fd1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nokire-sekiya37 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 410af9a6f3a201bb164af56317fa75f0d947f866233a97bc3da58f2436adf99a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in akanai-ala-aimava (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c36ecbc4af419bcc63b0f62a19c650cade5dd1354443b6163fbd1dbecb6127a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-144072

Malicious code in nabuf-ogaf-doifaogako npm...

Malicious code in tealove-reborn2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84e70fc4dea059cea9f2eda5ffdc88747843018a6c82e51d93ca5a219267d953 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in salabunli-nalikabuia-lubi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a84a6cf6c911e932535801ef783a6e25f20c40e67800fd79fb657ad29a1fa928 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bitha-79 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 686d9886a170b562291e77af799948b0f5a7295bb00a491d864df1e784232eed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sabudaaopa-muyua-bagfaug (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16d952dee3e8e9fa0a1d82976fab8fa4cd8edd272eebdcff5bba7c86c653d274 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lookingan-namakita92 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a9642ffccafdc9b4de1e05a95dcc518fe9f2d9510cec45a3bf22c42414ab806 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sabua-muyaig-bfu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8091edd90f5457f2b8ea61a4093d5b125ebb3e7468eb98840e2a9b7aa62ba8b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in icha-95 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cede944656044dbe86fcbd24b7a386653b249221204a86110e6206a45ef0285 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...