Malicious code in @mipta1/ewraa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b96f59f9960ff9b8264388d29f50c9a60ab26043368d8547e0d7882154ae59b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-168689 Malicious code in tealove-reborn15 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 539992228c4da68b4159e4bc0bdf18ae9cf57ffe5c58468e2564ec982600732e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-8998

It was possible to upload files with a specific name to a temporary directory, which may result in process crashes and impact usability. This flaw can only be exploited after authenticating with an operator- or administrator-privileged service account...

Malicious code in rigel-bootstrap-triton-hyperion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99fdd7d5010c8bed6bd41e03d61290b096febab526e48988e139d60019cbcbd7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eris-forever-nestjs-aquarius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1406fa4bd80fa829b6a7321e56951c0d3568b801f7775b62e7a21d9f256495d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in umbriel-style-loader-commitizen-spectron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e4f5cea50260213f84fcf4c8f2451da124b5cea0c4b36de26b768c9018810ea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in avior-commitlint-config-angular-cypress-quark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a27fabc8b6619c335527c49d2b8fcb85fddd7995173052888ec6ff565c9fedff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in carpo-npm-jsonp-equinox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bf17a58354a6b6dc7eb832ac70269acbd2595c64fbf4b932f381403d3705113 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in yakutsk-postgres-tool-node-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8249a23f43ad24e6e3e5262de5dd34c85e91c3d96c59f35164cdc3b1899fb203 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gacrux-sedna-nextjs-nconf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e307a27a7c1667b7b33c2efac98354eefe51925d335545339cebbe0277a3aa8b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in repository-dynamo-yonder-bunyan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d74467515ba66c4c45c2cc1b0f974b8a509c3325685af2845e37ca5c06633032 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fetch-jasmine-frontend-equinox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfc5d365dcce5e2b678e7f28c3bd51608c01363800de40988c29530bfb10e1f9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144669 Malicious code in magellan-toml-pyxis-spica (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc6dc533b7eafd1a447732d5171a98cc252177054638dda40dfda403bdeecec8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146435 Malicious code in postgres-hydra-weywot-sagitta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9f121b1962f33f6f178f0b9f8dc9bee590afdb80f5fcc6e4a087f70a9f74232 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143849 Malicious code in jasmine-dione-antares-envconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8eb24375a86ddb152593c2601b25c78fb8d04c3eb3a1ff03cf84d53233ccbc5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148862 Malicious code in typeorm-uninstall-rigel-sadr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5064093037affed56baffbb0373765a99c6ab2325928393136088d3d07e36625 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142766 Malicious code in gacrux-ganymede-fomalhaut-lint-staged (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a1a8e305affdf35bf9259a55af9f339036df0c226f0a7e230b625d81909cf72 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146752 Malicious code in proxima-xerxes-phoenix-adonis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfa53cdb21883c83010f5b066e9c80d22153325969ee802d62fc3eaa81e6b529 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144791 Malicious code in meissa-async-backend-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eae020ef04000ae33c4e46477a081b1baf7225fa7cc6fc04cd4abb86305ced0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149515 Malicious code in winston-nightwatch-sagitta-aldebaran (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da665bbaad7488248480eb32e269a4365ff5d2185af8c41490d02639d46dc5b9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...