MAL-2025-185397 Malicious code in aether-start-lepton-mdx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e36aedbc551c0fdb6d6a164bc853c5330db99a2f5ebdc2bd7c415435ac4acf66 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189551 Malicious code in soap-auth0-tailwindcss-convict (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ec2c20f4554ecdd1eb1848e47edc8c1868596d8237df69b171abc1da7ceb1c0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186002 Malicious code in capella-yaml-innercore-hermes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 372f99cb9ed94cef8bc325e39ea217a894b8578a523b5ea09806bdeb8df4ca2a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sagitta-antares-winston-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ddd0b309f243a59e5c481a498f75eb1c403e12809499a7c5b5fee2a091da4f0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186868 Malicious code in europa-fork-andromeda-kinetic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f06c976d398e6600330ef91542a8aa6d3f7aa644912faa1db980b04078a6339 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186551 Malicious code in deneb-speleology-sadr-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e2115877a86f398809a8cd4e24914e3278660470c511e3a1fd3feac3b5e1ec6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in heka-markdownlint-rollup-node-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3918091bf1dccaa7a82585cf98bba21f487de7dad3e092c4d5f4c7b1b3c7e9ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188650 Malicious code in phenomic-avior-greatfilter-boson (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b201e815b3fed6dff5cf2c8c8dd8e975795b4c086f7ae845825da2bd13da55a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-190407 Malicious code in xo-koa-metalsmith-perseus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bc93d08c628e258a21edbc1a71b39f0d152d7a6764acf3855fe0a3c44f76f60 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186738 Malicious code in enceladus-sirius-radioastronomy-octans (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 24f57bc69c731ec02e2811fda830912031459311f70ab51b01296169cfd7a5c8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187902 Malicious code in magellan-gammarayburst-passport-antares (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af4ae1a2fe9cec34c0b28482fc1ad0e92f4279cf6167f43e0c372d9c6b17f58f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189957 Malicious code in tool-pino-xenos-rollup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d08fe06f64a30975c203a857a87ca23f3ddae2ca1e75508202c57616eece815 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188271 Malicious code in nextjs-tachyon-apollo-cosmos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5808e78b34136ebba63563f7cd291a9023ea14a6a89294689d6a76ff25855793 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188856 Malicious code in promise-dog-link-authorize-boolean (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1611eea74b726b3946a61925ceba39c59029db92f76bdd65a1251f03348d7c2e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188749 Malicious code in plutology-ariel-subscription-meissa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7586875995a9248c1bb0d69061389e43a86bfb28b5f8a11e6aef21281d3ed47 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-46917

Name of the Vulnerable Software and Affected Versions grist-core versions prior to 1.7.7 Description grist-core is a spreadsheet hosting server. A user with limited read access to a document could access endpoints that reveal hashes for different versions of the document and obtain a complete lis...

Malicious code in imodiov-kufi-cwimoi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae055425a99dfba27d814fea570ca7272df9a52298385c10929fc126b6a2a244 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in manu-oifads-gsisofait01 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8360faab652e6b1eb0a0d9c1e216e90c743b46486f07d179154f38ae5bb46a72 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in flights-tuig-alaka (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc388fb6de465aa81b4008ff2eda398c33eef0bf03fdde8173048c649d42f3df This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gociay-uinaga-ugugfafu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1608251dfbb42e646c25a985771a29be3cc83bffffae79adad4db3f9d0dd0bc3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...