EUVD-2025-111867

Malicious code in lacerta-magellan-sagitta-dotenv npm...

EUVD-2025-111835

Malicious code in leda-koa-dotenv-safe-atlas npm...

Malicious code in buffer-transport-dotenv-thuban (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4d83035ce63668bd4eb199426469192d2492c2d5e513bc731b0d837d9e29673 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bunyan-dotenv-parse-variables-bootstrap-wasat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6a361166347995f8a1116d8387938ce82cbbd896b8be9677f14169f4f20b7a5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in callback-bellatrix-dotenv-safe-nextjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e86a7248a8eb2b1c9dcf387615c6691ab9242e4d8847479817c6adc571471ff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cassini-titan-dotenv-babel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acc1b1f0d86e23bdcb14c99f809d2b93e7ab46cc2608e1c4bb0bf300f6d8aeb4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in commitizen-ultra-event-dotenv-parse-variables (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdf641d61b7de3dfcba8daa85c5581e21a1d8f2b58e574d6a78735cd2319a2fe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in corvus-perseus-chariklo-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a32839493716ccf5866966fc2c0c28d2135ef1a738aaac9f3df7a8bb551e8de This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cross-env-zenith-dotenv-safe-cypress (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c706bc6f96881376f528379502aa33a8a6d66dfcac8b158a6a76b4407eab669 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in deneb-quark-dotenv-safe-await (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79765b50847846187d16a72a0ce89db9097d30c7599971e7283f47b87b0a8334 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dorado-local-dotenv-safe-spawn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d65cf7abaf0a3cc4bc9be9d18b01ff806f8e740363dee4a0772a1daa3691af8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-parse-variables-axios-rimraf-socketio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a74e83a98501868b14b36dc23df3d406f687182616811541cd1317ec9c0d1129 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-parse-variables-despina-helios-venus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 394b18f97386bd3801ef7412aeef0d1251cf070f9cc633a408bae11d7719e5c1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-parse-variables-got-hermes-octans (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f25f97964c2f26070ac5974345a378e144d266f2570ec41d0fa375f8934c90a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-parse-variables-nashira-hapi-iota (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f13e1d855ebbd081de4732709aa42f352212523da47dd75c981a0026bc5281d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-parse-variables-ora-aquarius-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ff8e83bb1b3ab4c34714f6ba9d7921da13616d537496b69657f53bf7cb62eb5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-parse-variables-rehype-webpack-dependencies (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be0b6deac8969176b38f0fd93430562f99b91efa0466cafc73a3c3f46527705c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-parse-variables-yonder-flare-indus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49784ee3d9dd79f226089b8f80f8a69cdef17610770db6905ee6f5d95977d16a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-proxima-reveal-md-avior (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e0b1c45f986cf6fbc4af0e177909c6672bece01b81cf95400b5748e8436cf14 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-safe-bunyan-private-umbra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4780bb51498043095d7629cecb40fa21a3ad1bfe31e192d0c8439d367eb40719 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...