EUVD-2025-176687

Malicious code in repository-reveal-md-multiverse-quasar npm...

EUVD-2025-178300

Malicious code in janus-repository-acamar-jekyll npm...

MAL-2025-185640 Malicious code in atlas-repository-nova-eclipse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84fc45a419be4c1ce2710de99244938901158da76b1ac1d2918bbfe8148ef905 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187486 Malicious code in innercore-yildun-blaze-robotics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c6a67c1532daa0289287aa51f609d0b21a44bca1e258d173afd670f7b9aede7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-178658

Malicious code in greatfilter-repository-on-proxima npm...

EUVD-2025-179244

Malicious code in draco-cygnus-repository-aurora npm...

Malicious code in avangi-olia-tabialauoa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c8b710b86d3016ef9abd90467c7aa604a91c037f251944bf359c3bd01a15559 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in one-kiat-ibudavrda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 754492b1e111d36a2e4e8437b6e7da80e0c598fee24dd8be639d8331f32e32ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-koig-tmoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b1a4089fd58ef01c9fbf48e10bd06102b39b8a3e43cef24d740016338d08b62 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in masv-ilo-civasavuinaum (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48cd3a284fc9af45b52359d4a199709b8ed90713987a0338cf89336bbbd530bd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-184471 Malicious code in mok-luni-huojakiavuggijim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebae8d231bdab2d563d6ecc7ab40bbb8c42b5379279479fd96303d266e411f8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-183000 Malicious code in itale-dci-rfrt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8081936317aabb1d804cb6fa6935078fc970eaf224cd64c6896c3563bf751fba This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-183997 Malicious code in mitok-doni-olodagivl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40daf3cb74df623df19cafda754a1a92395158b6665fc72992053de3358bf36e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-183624 Malicious code in mahnu-nofity-gaomni (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f29e1d83085ca512494d9559f31b5b3e577728c2c0f00eea9d11836e47aa3ac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kisut-diufg-difav (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80c999b9aed165b620acb2879d34b94b34bcbc80f2a42125b86acb3272a64769 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-182183 Malicious code in gociay-unga-fafu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8f045bc08921b29101aa7b317d0d92b48a7ff9ce3d4bcc388e61fd1f46d8e73 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in itale-adci-hykaulagg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector baac91dd7e0f3db1d19545a00223bde0808f881da492954b51023d6de129f7ca This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-64482

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap Community Edition prior to version 16.13.99.1762267347 and Tuleap Enterprise Edition prior to versions 17.01-, 16.13-6, and 16.12-9 don't have cross-site request forgery protections in the file...

MAL-2025-181565 Malicious code in roti9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0eadce8cdcf9587f89d13b5c29efe37321115206696aab61a14c8443a09f953c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-64482 Tuleap missing CSRF protections in the File Release System

Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap Community Edition prior to version 16.13.99.1762267347 and Tuleap Enterprise Edition prior to versions 17.01-, 16.13-6, and 16.12-9 don't have cross-site request forgery protections in the file...