MAL-2025-127951 Malicious code in kresna-kue55-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb43ed1176e257448ebb60a2049dfa3a23571f1259fda7d03c70097bc52f0183 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in coastal_clam_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a94377168e59809ffe797e506927ff48285af148256850e77d21c759320f2d94 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in riana-kue33-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4012875016a07e1c4c1b9349ae37a32af4f670e39ebeaae45b8d31010c1cc7a5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tiara-mendut12-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09b79d49f6412b74b9159f1dd6d2d564c3eec9c29ea3fac378df7f1967e093e6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-122268 Malicious code in ogi-ketoprak29-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cedbd787ccaa3f9f330eccbac8d453fef57de69c167c86b80574cd44410d0b17 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-121762 Malicious code in managing_tiger_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcfeee50dcb95db92a8755b9f89f39cd55943780c248214d08373073e05b343b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-122612 Malicious code in putra-klanting62-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a915a5c3161b6dcadce23d9ff7cfd3737ca115803621520b6c0d08d7d329b3c8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-123975 Malicious code in vera-rangi26-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd510b313adf1975e20c32a94eb3be8a0317fc7e02b5d3ba89d465c1ccfc8853 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-123284 Malicious code in siska-liwet68-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c8cc1def5a76083dbc9cb5c4d344c1d3063c855d4d07ff2b749751ed3002cbe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-120230 Malicious code in gilang-bubur88-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65e898f4737f6a552e6eebc941d6f1f16ff5ab96066c93c808595b8d98de1634 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-123808 Malicious code in umi-kue89-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1de10bc5fdc611bf2396b2bbcfceb95e93d541c3ff8b3b2ded0e920775b8bd82 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

curl: Hash exposed in public repository

An image hash is publicly exposed on Github Steps to reproduce: See at https://github.com/curl/curl/blob/master/Dockerfile Solution: If you want to keep the hash, the repository should be private Use official tags without specific hashes or environment variables Best, @skymander Impact An attacke...

Malicious code in adorable_fox_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a27e7786f641defd4833c31fecfceeb0c93f407a4d3bf415d2804571e51d751 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eka-nasisayur62-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 798f20dc374552574746f3bf67dd47c4fef519b4239d9caab324e5ff44ea0985 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gilang-tek7-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae569d973044081bce608eff80217b42fb151f864c0ebc289788f9ec7b410e91 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hilarious_minnow_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c76b23a0ef32a175f7acbb62714fd70678854c1a5249438907593d68f47f8c0b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ida-gandul67-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 219f09fdded66e7a86788edaf488ade68420ed5678a3b6a2135708d117c355c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nurul-dodol4-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aafc609ed993aa96f3c739143f6517cb85e31b77d43e76929a8b0e821b729638 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nurul-teh70-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e568bdb27ffba9ad4e1952831e1110206b8b406c47125d4bf33ae6636bd87bc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rifqi-jus58-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ca6627395757ff112f1ee1d273e811fadd8686b4dbfd2c9d381bb88d0f89759 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...