Malicious code in mahnud-unag-goi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2413f63a915b10225a2e308060b007b27d9371270938673936b045064621de15 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spawn-sirius-venus-jovian (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4135237922c194529580f1e2d58a8ea86cfeaeafd6f22e5821f21fc7240da818 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-136882 Malicious code in secret_condor_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a413ce836db767a6fa4d7dd39e1599b88a33c4b84c073ac347886b56b516251 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-136881 Malicious code in secret_bird_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c14fcc7b14bd5901bc970a77de8b9502ed2bcfebf97ca47cce0ca95952190b6b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

podman: Podman kube play command may overwrite host files

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the targ...

Malicious code in secret_roundworm_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b37c295e0aa4df7bdbffed8e42d04a9a8043fdc00a88142f96ea133a828f55e7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-88883

Malicious code in secretgeckoz3n npm...

podman: Podman kube play command may overwrite host files

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the targ...

EUVD-2025-75692

Malicious code in secretsturgeon-tool npm...

EUVD-2025-73809

Malicious code in secretalpacaz3n npm...

MAL-2025-96483 Malicious code in secret_bonobo_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e80295bcd27cf89ba769867caa03b4824ae2a788cf81bdf27bd369f31c3bcf5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-73807

Malicious code in secretbonoboz3n npm...

EUVD-2025-73805

Malicious code in secretnewtz3n npm...

MAL-2025-96481 Malicious code in secret_alpaca_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebf1170e6a82c6669653aefc04de05dc9336ffc061cf8a3f53d0e948d7c01fc5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-66803

Malicious code in secretslugz3n npm...

MAL-2025-72706 Malicious code in eko-lapis27-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c120376d33866655a33d17d1101218a713f4867f06a1120472927ba3898ab24 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-76659 Malicious code in rulesdir (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c805fe99761f008f2684b4317d760d59a99462becf37b554d6673444045ae3fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secret-chocolate-haddock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54d7bf5dcebb64a8d8783f6a1867987ed01f14577ada5e5c129f3c8bfd3e25fd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-52152

Malicious code in secret-amethyst-ermine npm...

MAL-2025-70502 Malicious code in secret-yellow-cicada (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4ad635d4c6091c56afe5a7e377f5e7fcd50e01e772744c49b10b52887cd85af This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...