EUVD-2025-141512

Malicious code in hokage-31 npm...

Malicious code in ira-37 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f063445b35750f510e52b772f5e670fc168d6327cffc492dd2b61d999ed304d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-143522

Malicious code in alvino-32 npm...

EUVD-2025-141510

Malicious code in hokage-33 npm...

Malicious code in lia-39 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6423acdd24532eb5725d0c41f83a800be1737080f4a0638ccdf5af0c927d9434 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-174767 Malicious code in hokage-30 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9d25c4211688d818f181dbd2f365a0c63a7f6c7fad00f3b268066f258216800 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-178315 Malicious code in riya-34 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15c06393078ab01499d4dc9be643be08885b3f232aa4449ad1637b973ffb06fa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-174970 Malicious code in ira-30 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b4e2dc723998f885fc6b543752c982334b21bb05497addc952f3fae19e6e81b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-131909

Sogexia Android App Compile Affected SDK v35, Max SDK 32 and fixed in v36, was discovered to contain hardcoded encryption keys in the encryptionhelper.dart file...

Malicious code in nasrul-poke30 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e78f6223726429ef764f92690e632c367291c5eabb792b710ecba598625db2c0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

siddheshtea (=1.1.6) potentially affected by unknown CVE via ruji-34 (=1.0.0)

ruji-34 NPM version =1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ruji-34 and may be impacted: - siddheshtea =1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-165260...

MAL-2025-157597 Malicious code in keyla-poke30 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f3765a44482cd50ae2101f98f3c2e7083faa151ab8f40ab3e8f69d33041f193 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rival-poke38 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0ec54c14dce5c425a195ddee454edde81c2afe1f460dd4e8e13fd7e1dd889d2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in billa-37 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 521364930eb4d57f7fac3ad981ca3260b96011a1f7e744fde3e9ad3659b732c6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ita-31 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71c374c976f5c5b3aa3d60dcfedd235a7a975cdc96b540e01fa7b3da5f8bb7ff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ita-34 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3116029675df219b901e45c44cd9ce4b7b3de08b1f578310252d53f1c3f92225 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ruji-37 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 153c67275750824a26b85661d1658b500f7713eee0bd9249c67691997d0cb48b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ruji-31 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f1a08cf40449d303425087fd2828ec66e60a59f2c98ae9328841b7e11be2200 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rita-34 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 995a4fb627d4f8d0d281a75da404836f9af4b45c3ea06e8dafefbc6404bf9b77 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in alvira-31 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bae6b71ab1249173e1d8b9140d0c3ad4eec75178ddda6b3c9b6550267ca04936 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...