Npm Package Targeting GitHub-Owned Repositories Flagged as Red Team Exercise

Cybersecurity researchers have discovered a malicious npm package named "@acitons/artifact" that typosquats the legitimate "@actions/artifact" package with the intent to target GitHub-owned repositories. "We think the intent was to have this script execute during a build of a GitHub-owned...

Malicious code in imaginative_impala_pink-64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d40ddbe379c47bb0c4d67f42ca72d7c1b8620af6fc4b3eb744c338379310c76 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in silly_cockroach_orange-52 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bef2a73bef34df68b9995395cd16a483bde504a625984ac47bcee2537e6fe28b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nutty_chicken_peach-87 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4c251ca57addc14e6a818941b9df2df607ccba089b727804f409f66763e6b06 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in safe_roadrunner_tomato-80 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb1442ee5f7daa17ac5f6ed372791075b69a5c03c45c4a392af5cff06b5c5135 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in following_worm_aquamarine-25 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d16261f0ee471a3bd1732609e5b854661a46a60253ea8d0687ebd9ddb2181ca4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-74572

Malicious code in hollowmeerkattan-52 npm...

Malicious code in spectacular_spider_magenta-98 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b02d5ef189199218d9d8bceae9530ff0ecf885f357c22427b3436e199c732895 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-112314 Malicious code in slight_reptile_salmon-80 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf0bfb1d9929c6148a9df845d6eceb84467129fff3b073108e44279222a74ce0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111787 Malicious code in dark_quail_apricot-38 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0309e6febce7225fd52559c5db9311a3f2e381127af9b7d036dc9a8a4cb4607 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-112110 Malicious code in modern_heron_azure-60 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc5227543fd581a3c36d3fcd61a4859f4d00ad5b0e8aaa68a760cc3e6a127d11 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-112014 Malicious code in indirect_warbler_scarlet-18 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8627c9e52b969ce498d00b9f3bcac65921a4f5f91f9017c41c66ecc1107a58 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111779 Malicious code in curved_urial_lavender-23 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64c83216d981a841de6e0e8e5b3dca29059bbf895237955768d731c48b9b26c9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111961 Malicious code in handicapped_whippet_tomato-57 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5312a143a2874ce99bda8b40cc47890b3505c2412fb8a4496e6ad464495c4a59 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-112022 Malicious code in instant_carp_blue-56 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 814b8cc80b08a2241897208d31f0967219eed21fc754eda6b4a053a9de4951ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111804 Malicious code in developed_swordfish_green-62 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82ed70876e0fb294c51323e1ca423a719a4c9ca6804f2f0b99cdde6d852d649d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-112377 Malicious code in sweet_deer_yellow-85 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67072ab662f77110148cc0c1e376f2dfb4a5dac2fd80b9a96e7576e89365ad98 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111786 Malicious code in dark_chinchilla_indigo-29 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e9d5ba23ac756c5b1f8cb75ec10d20b3cc0f4f3b3aca2b06212946232aa6b16 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111704 Malicious code in breezy_dinosaur_aquamarine-43 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7960241780a1cb3b786d40103ff74b3cdc651b6c84aae82cb5942d784103834d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bottom_fowl_blush-39 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f0e2799a2dbc5d9c557e480074764e0953c04397fd4a2524c18909bb18f2025 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...