coffee-son (0.0.0), entropy (>=0.0.3-4, <=0.0.3-7) +1 more potentially affected by CVE-2026-107353 via traverse (>=0.4.3, <=0.4.6)

traverse NPM version =0.4.3, =0.0.3-4, =0.0.0, =0.0.1 Source cves: CVE-2026-107353 Source advisory: MEND:CVE-2026-107353...

Malicious code in linter-coffee-variables (npm)

Source: ossf-package-analysis 292d0ff0a104c6e415fc2ea734ec189f699d6aecb4383502759e2053adddfb45 The OpenSSF Package Analysis project identified 'linter-coffee-variables' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Malicious code in limited-coffee-crawdad (npm)

Source: amazon-inspector 0da40e19fbaa953f7b76b07e89721980ce9da82a2b81ef3dd4ec29682c588650 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in light-coffee-lizard (npm)

Source: amazon-inspector 65a8e6c936fcaeb396e096a81d0ccfb8256f5b5328e3dc71baba7b8a729e646f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in left-coffee-dolphin (npm)

Source: amazon-inspector 74bb2862b252ffe6090295cb556c6580e056bb5fd122872ac8f502b8b47671a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

CLSA-2026-1789633448 TuxCare security update for drupal/coffee (1 CVE)

TuxCare rebuilt drupal/coffee to address 1 CVE. Fixed in 7.2.3-p1+tuxcare...

Malicious code in lean-coffee (npm)

Source: ossf-package-analysis 40091a9e1c992e1036913597e929c36c5b56682d022e7260f42badcc3705df8c The OpenSSF Package Analysis project identified 'lean-coffee' @ 9.0.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. -...

Malicious code in large-coffee-kingfisher (npm)

Source: amazon-inspector 17aa5cebbaa15376d7b8cea48402707727ea90fca9708543ccbe9e4b3c87c979 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

PT-2026-99525

TuxCare rebuilt drupal/coffee to address 1 CVE. Fixed in 7.2.3-p1+tuxcare...

Malicious code in jealous-coffee-trout (npm)

Source: amazon-inspector d751f8817e741999389582fc83f6f25d53aa7511f92ba071cd3ddd9abdadc918 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in irrelevant-coffee-earthworm (npm)

Source: amazon-inspector a0c260a20a1236963509af69c32ae15248baf1b30e7984eeac4c28d3cf0ee740 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in inner-coffee-cougar (npm)

Source: amazon-inspector 7cb43827b00821192d87d2a4d4845c49c20d444a2340c9207a68c747d14b9e26 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in inherent-coffee-gamefowl (npm)

Source: amazon-inspector a56f526985542c41bd32e6433b7f3a3fa3496c5abb254554ab888707d85913d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in implicit-coffee-quelea (npm)

Source: amazon-inspector 80713ac28a0a287d70171707490645760a9f94c8c115d9159082276af4f8e802 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hushed-coffee-bobolink (npm)

Source: amazon-inspector 09f4742e713f37154602c5a6c01699e8c3933745bd265ab13101623db6d30c7a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in honest-coffee-minnow (npm)

Source: amazon-inspector 1406aa72874941a8a7f6fd7945f03d3bf24637361e0bdc114533806e891f48f9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in homely-coffee-marmoset (npm)

Source: amazon-inspector 6888b7793daa45c8e25e4ba636ceab1f3442f3e18ac5a06219afc6adc5ff70ad This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in historical-coffee-quelea (npm)

Source: amazon-inspector 3b6593f025cf4fe4473f5fe807674daf7dc74ddcd5183077aec7803f195a005b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in gleaming-coffee-tortoise (npm)

Source: amazon-inspector 17b43f4c2b5848d86efa5744cf43311440ef501bf026698105f5a270c5f948a1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in fantastic-coffee-lynx (npm)

Source: amazon-inspector a41743e8375d7391d4ad776cf5dc872cf1cca001233a0b52790a079db971f452 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...