MAL-2025-189313 Malicious code in sagitta-izar-dagda-nightmare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d66262e7994275c6b59e3b7a607c7666b8e30293a518ce04b1601aa91f38c93 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186868 Malicious code in europa-fork-andromeda-kinetic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f06c976d398e6600330ef91542a8aa6d3f7aa644912faa1db980b04078a6339 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in config-event-install-lacerta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53b410cef5e278f40d1683c3c77135d349c9f67e0537b356d77f55cbd71a3c50 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xml-eris-lyra-tectonophysics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f15351ff000357cf55920a6174c8fb220b1b8986f075040a4534a6af1db182d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188749 Malicious code in plutology-ariel-subscription-meissa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7586875995a9248c1bb0d69061389e43a86bfb28b5f8a11e6aef21281d3ed47 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189732 Malicious code in sun-cold-upsilon-deploy-hash (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21e3fce7be21fdbff197cb712d6763d9e3425bc78c5e5602348c426d97f31711 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186703 Malicious code in electron-pm2-toml-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f39fb8a9d75395b1785a187dc32fd7123d42ea214d0d3cd4f9526ff421b0a685 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187259 Malicious code in hadron-pino-pretty-hermes-jabbah (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7736f6786b89ecd00050315e30fc0bdf0f69210e399f441ad491be82bcdbf870 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-46917

Name of the Vulnerable Software and Affected Versions grist-core versions prior to 1.7.7 Description grist-core is a spreadsheet hosting server. A user with limited read access to a document could access endpoints that reveal hashes for different versions of the document and obtain a complete lis...

Malicious code in poliaoz-ali-ava0nubu0ku (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdb0d66cbb2c695b3d0c0a0dd4383ce96503cdcf8473262d9ce478efab9bc593 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in itale-adci-akontolbapki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afdcefe63fe2cba0558fd0e01a9b090046362f52a9b12c4e2dfaab51fa64f9c3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lobac-ubb-jfga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7daa846c4290a4ad13294f14edd560bd708b92df05f61e05c3bec450e4fe3811 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in imodiov-kufi-cwimoi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae055425a99dfba27d814fea570ca7272df9a52298385c10929fc126b6a2a244 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lobac-ub-jafgf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cf002b5501cbb7cb8e8bec2e53e337007fc06679d21ca426ef80df41b687da3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in itale-adci-hykaulaygg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b8ce7a4a863926396a7fc78a11d5d4ef2a15db676ba9429701d7b48a917ceb2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in avarag-obis-bidabiala (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0340cc31f16f104495847841a7843b4602b250c4b803e603b8ce0845edf4078d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lobac-ub-afdmafdu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 180075a6d520af100a1bea60a08b5a06cc2128a97fa0c2da36bb912b3980c8d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-kuig-tnaav (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c871d46320533cf44f20ca6345eee76fb7ccc7602d3ef75e794d407e5859c1f7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in moki-nik-hujikakiabalbum (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdc35b04674fb8c617313394ce9a9f857cd279e096fbb8c247deabae6fc5f5ef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in masolv-avlo-cvov (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6d41b3d5644fab1ba36b595de637b58d7f2682208565b51a106deb961937b46 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...