MAL-2025-117798 Malicious code in vera-rangginang39-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b459eff662eae359f4c790f799d7f138946e08a42b0155679d132075abe6ee3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-117716 Malicious code in utomo-jamblang17-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dc700ff90f6365a319d1d8ea0935afe57fd5b0f07c536ea19bcb22f2557b359 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in putri-kue93-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4224edff97aae510af51e8e7b025dde29b9752fb701ecab3278fa7d65909474c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-114778 Malicious code in indah-peyek82-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c776eba72a951378779a82c0e01313b610e4790347e68e37919adb9f01cecdc3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-116955 Malicious code in sari-ketan35-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd2c7e6f59859d0c5a0823ff4d18b2951d35943dd55ace5c0764a752317fb0f7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-117677 Malicious code in unexpected_dingo_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83fe663c57a8d5879a23405c715eb9de759272cbcefc1204b421775224c85918 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12155

A Command Injection vulnerability, resulting from improper file path sanitization Directory Traversal in Looker allows an attacker with Developer permission to execute arbitrary shell commands when a user is deleted on the host system. Looker-hosted and Self-hosted were found to be vulnerable. Th...

Malicious code in key_albatross_orange-14 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d268671cec5e80ea66cf5a1827f8ecb2eb829ecd76db8d634c71ff286e1f1e30 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in marxist_sturgeon-smiletea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5744873204580592871c4fe41b504defe00fbc009c7cda54cd08c3b52fa0f210 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in qnnkan-devapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84fba9cd6e1f1fb39237b9e93728fd33c0a5c50f3ba8843bb7f8635ffa02f00c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-99356 Malicious code in alleged_guppy-silentdev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2b8561cb3f2cc04bb28bdd12af89fb87df2429ae9eb716c4743a2475685ed5e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-106066 Malicious code in mvtuah-devapptea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6c5da87a5df320dc634920e80d7803bdee52d1bc9fe7b2104067616d0b56f5e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-110985 Malicious code in wonton-notthedevs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58ae31bc1ebffdc021ae87298c02005ddaaf0ae2b5efca2f12fa53b35881d093 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in quickest_woodpecker-excellentdev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1f592df82d9c0671aead367d26cc922ace2f2719654c3f1d233355473111e0f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in expensive_roundworm-gooddev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e40d4dd59ce6497e1ae95a347a9cfa40f8e9767ef3e36cf87cfec7f6b1d877a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-102666 Malicious code in fellow_goldfish-appteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46037a3b753896dee2453259512fad330db1f5121fd7dd6e4fd947dc738bba80 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in original_stork_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb245686e4c06e038f368b10e7679be9f656e01724714cdd7e9f79a3113fbe09 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-100927 Malicious code in continental_echidna_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0496011fd17a29d1751cde9c1f23c8ad3aab71c205d82c8af22569b70bd2ce82 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in growing_bear_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 522f7ea4f708b69ee0a1be9b8cfb58de65cfcb019da2c6f424dedf47e38d9e23 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in stable_tyrannosaurus_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 338cae6fc1150d3977804ce22de50fa32ea2b1008ebf89021a6bf2e300ad2f62 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...