Malicious code in southern_cheetah_harlequin-58 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 564b1cff2590ee033dd1704ed1efe01deb4cba220568f73a122339387afc2e81 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in medical_lungfish_blush-7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd6af0ff2da23d28a9100dfb44e51bcb3240dd805c452977ca08c129cea4b2f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mean_mammal_chocolate-62 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3889521ab35d1f129407772baf9f5c5f08b018c4df92db74ce86eb1e9bc84b59 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-74597

Malicious code in grandcuckooamethyst-49 npm...

@abangkuro/bluu (1.1.8), @awee1233/bluu (>=1.1.5, <=1.1.6) +869 more potentially affected by unknown CVE via bluu (1.1.8)

bluu NPM version 1.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on bluu and may be impacted: - @abangkuro/bluu 1.1.8 - @awee1233/bluu =1.1.5, =1.1.6 - absentaspaquamarine-9 2.1.4 - absentjunglefowlemerald-72 2.4.1 - abstractorangutanaquamarine-80...

Malicious code in financial_llama_purple-44 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 208076eca32696fe87340d3596c0b028c07ad98c3a4d6b5fd6391667bbc5a1d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in soft_cicada_harlequin-99 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 304655ae80864f227dcbb2d094d4b0279495a9990fca6b65af7bef2c2ae9b1a7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-74880

Malicious code in asleepbeetlecyan-97 npm...

Malicious code in confidential_hyena_aquamarine-59 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7fa6876051c2ca2199417b9f28bffed66f2f2df85024bafe0d25def5acc9f18 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-112442 Malicious code in various_coyote_sapphire-75 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29528afecd3de002466106f1a21b41a738aebd201cb5ed297434966c8ba662e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in organisational_hamster_magenta-20 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ab9164ab1f5edb109890c561ae02247b17c0fac1fd211bdab05e81096201170 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ytterbic_toucan_blue-98 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e5401f5ce0e0cbe03c00e78610e26a954e2aece325fa9abde81ea4b1d2a8f1c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xerothermic_toucan_amaranth-81 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b574a307ea432a2cacd013af1fbf0af6701e92012dd8fa0f5a6df71381e5a98a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-74273

Malicious code in secondarychickadeeamaranth-93 npm...

MAL-2025-112355 Malicious code in steady_halibut_aqua-68 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21b55285bb22d0c683c115ce71db120f0d1445492c65a7390d763d0e9efd10a9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111883 Malicious code in external_sheep_bronze-18 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1984bdb68784d43e640e356c5677a54b2cd0edb6555d5238a06bc790caef9fdc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111821 Malicious code in distinctive_bonobo_green-36 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cca37629d6d3005eda704d9bb90ed1c6282d5b8c4c9e84d84dc7072d19a9fda This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in shy_carp_coral-99 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 931a2a9824d3b75c21e49930460c954baebafcfb54f41c20aa4ab09166edb49b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-112469 Malicious code in whispering_moth_crimson-56 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec77cbfec95aaefdf6932d0848ed4a0dbe938a0793d0c67b1a71bed2a8e4ff4b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in future_grouse_rose-37 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3ab72e665999aaad9a32ec34444c80cc4015cce19563d92d01bf1dcb96fd823 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...