MAL-2025-192376 Malicious code in graphnode (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 981903800087e4528bba3ec6bb841e810feaedfa490e7f078fcac9c9d663e4ce This is a malicious copy of the networkx package. It contains an obfuscated script that downloads and runs further scripts from one of multiple locations, and...

MAL-2025-192364 Malicious code in blank-lib (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 96f1bcd77950a6cd42af11d0d4fb4ba3d58349cfde6236027341c044e152bfeb This is an infostealer, based on Blank Grabber. It's used as dependency in other malicious packages --- Category: MALICIOUS - The campaign has clearly maliciou...

Malicious code in jsonschemex (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 21f678f82847db32c68ab5a95a827f755d13b5d4cd371667eb584f25ed28ed01 Malicious clone of a legitimate package with hidden code that downloads the next stage scripts. Analysed payloads had just exfiltrated basic infos --- Category...

MAL-2025-191758 Malicious code in hexdecnet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4ca5c3aa5b553fffaca36241e0e3a6144c9b661b9e0cb77fd93ae34fc6b1ed7e Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

Malicious code in hexadec (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f9d0ae8ccf24a6f5bfc3a0d5e39a983576d6edb2c64d9fe31fcb758236a4aa25 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

Malicious code in sanitize-new-link-code-void (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ea502fe1787665ba66414467f0d22ea7bd53a05d1a42ad35bb8974b5d525531 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186373 Malicious code in cron-kappa-bash-serialize-beta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53deafc5f542e358e2be400b3647937108a888871b1dd73316f4f4157605370b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-183647 Malicious code in mahnu-noy-gtaoayaigaa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e28e2ef24e450f5d0d5dcd5418b04f4a1e10f4be95da9244b50776954a2b3b9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in python-rootpath (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bb867560d676e7b79ce110b230906a9630feb223cbcb6072bff5a2636c60a3c7 Hidden code downloads, saves and import a remote script. The package itself is a clone of a legitimate "rootpath". At the time of analysis, the remote script d...

Malicious code in kupa-lubizfzlio-igugfsdu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b913f84bc0b6988929e9411617620a46cadc2f71e6d2a703db67cfc0d52762c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149954 Malicious code in @mipta1/asewar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20f26bfa91ab985696f17da457731e25e408fef0cbd0184ad9a97e0458595c23 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147935 Malicious code in sirius-antares-quito-meissa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb14f1e0ab037152d92b6e9a004a7710057e78b13dea45ab58a2b501256a79aa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in clever_leopon_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50ae84a26582756ae6f0ca2fc90d4130aa82da0e9bab75367911d67be22aaab7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in umi-lapis28-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b41e266887df7161cf8261dbb371b28e4e905845edb2430bcfbcae579391a95d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-124973 Malicious code in anonymous_hummingbird_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7a41d92fdf149a0af617bd73bd8f74913adf177cde98c27e2686ce012bb5902 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-122451 Malicious code in patient_stork_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d34e65a924b2c16c7e29749e3ebc30d29a907cde77655b8c80f923719d8614c0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-115856 Malicious code in mulyono-empal49-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 305c014e60abc6c75f20ceefa7ff9b0fb2db390e0a09a8442e3db0de9a36df36 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-113308 Malicious code in dewanto-gorengan70-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b03805e19eb262731cf47d84804989ff77ef417665b20acae5dc0330f829d92e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-101515 Malicious code in dian-ikan26-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19d580563640f5cb0e9243cb5f09cf15aedb023b04b4a8e42b55b36b900b5248 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bambang-sroto49-apidev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b0cf65640547f25852a41cbf50ebe1360b3208764543ac5c9fcaf6fc4e24fe1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...