MAL-2025-122612 Malicious code in putra-klanting62-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a915a5c3161b6dcadce23d9ff7cfd3737ca115803621520b6c0d08d7d329b3c8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-123808 Malicious code in umi-kue89-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1de10bc5fdc611bf2396b2bbcfceb95e93d541c3ff8b3b2ded0e920775b8bd82 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-122268 Malicious code in ogi-ketoprak29-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cedbd787ccaa3f9f330eccbac8d453fef57de69c167c86b80574cd44410d0b17 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in coastal_clam_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a94377168e59809ffe797e506927ff48285af148256850e77d21c759320f2d94 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-123284 Malicious code in siska-liwet68-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c8cc1def5a76083dbc9cb5c4d344c1d3063c855d4d07ff2b749751ed3002cbe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-123975 Malicious code in vera-rangi26-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd510b313adf1975e20c32a94eb3be8a0317fc7e02b5d3ba89d465c1ccfc8853 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-120230 Malicious code in gilang-bubur88-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65e898f4737f6a552e6eebc941d6f1f16ff5ab96066c93c808595b8d98de1634 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-121762 Malicious code in managing_tiger_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcfeee50dcb95db92a8755b9f89f39cd55943780c248214d08373073e05b343b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

curl: Hash exposed in public repository

An image hash is publicly exposed on Github Steps to reproduce: See at https://github.com/curl/curl/blob/master/Dockerfile Solution: If you want to keep the hash, the repository should be private Use official tags without specific hashes or environment variables Best, @skymander Impact An attacke...

Malicious code in nurul-dodol4-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aafc609ed993aa96f3c739143f6517cb85e31b77d43e76929a8b0e821b729638 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-114671 Malicious code in ida-gorengan94-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68ca95f6ca80eeff29898504888b3090bc33f1509e74f685fc70edc73c071dda This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-116313 Malicious code in ordinary_gull_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f391c9ce670959e4436c40bb2320ac32667083edb51f1754e337ecc05b3501d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-114523 Malicious code in hanafi-kembang36-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9cdb8d61a34210aa7442fc70ab58d599cec4e08980f6a77b14f8b5139cef39ae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-114582 Malicious code in helpless_takin_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f639f861af91f530f57d0157b06bdb5d33bdc65826980a2da9c0e56500b79fec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-117272 Malicious code in surya-kupang11-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dbd7dff23459e9770c9f36803504cd297970f6bf28a360e37264e347660b10d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gilang-tek7-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae569d973044081bce608eff80217b42fb151f864c0ebc289788f9ec7b410e91 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hilarious_minnow_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c76b23a0ef32a175f7acbb62714fd70678854c1a5249438907593d68f47f8c0b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-117617 Malicious code in umi-getas47-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 642a4f0d3690d5a88bf0510f17d823eda00dc57592e85731ee43f19e60502d35 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rifqi-jus58-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ca6627395757ff112f1ee1d273e811fadd8686b4dbfd2c9d381bb88d0f89759 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ida-gandul67-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 219f09fdded66e7a86788edaf488ade68420ed5678a3b6a2135708d117c355c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...