EUVD-2025-113767

Malicious code in exec-ignite-hermes-process npm...

EUVD-2025-111120

Malicious code in mini-css-extract-plugin-semantic-release-rimraf-hermes npm...

EUVD-2025-114953

Malicious code in corvus-hermes-kronos-optimize-css-assets-webpack-plugin npm...

EUVD-2025-116578

Malicious code in apollo-quasar-hermes-dactyl npm...

EUVD-2025-116577

Malicious code in apollo-rate-limiter-hermes-atlas npm...

EUVD-2025-112410

Malicious code in io-non-blocking-hermes-mocha npm...

MAL-2025-143298 Malicious code in hermes-aether-castor-europa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62aca217b44a643af9a5fa2ca7740f27cafaa83abe59fda3ae8724b08ed39f1e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143329 Malicious code in hermes-superagent-google-koa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 839f7222c322fbdf927457e0e47acfabbdf8739f68a3152c7bc8f9f55b0b19a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146508 Malicious code in prettier-stylelint-hermes-package-bootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30ba28e1dbc4cabd7ec966be39af97ff046d7a35a1089987eab1a33943663d01 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139525 Malicious code in apollo-rate-limiter-hermes-atlas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30ed5470b13fef8da440abc68f510f271994401493afb95ea428c871fd94bd3c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-120490

Malicious code in weywot-google-eridanus-hermes npm...

EUVD-2025-112187

Malicious code in jest-hermes-configstore-supervisor npm...

EUVD-2025-115895

Malicious code in bulma-command-betelgeuse-hermes npm...

EUVD-2025-114736

Malicious code in cygnus-levels-subscription-hermes npm...

MAL-2025-145047 Malicious code in miranda-pino-pretty-janus-hermes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 453d26f45ed78c5c4cd7d03280b37c3807f37e71e097ba1e130022966b51991b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143324 Malicious code in hermes-relay-mensa-rollup-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41b7840f7cacb1472b789652d724c055490d06c02148c37251adb38ffaeff035 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-122228

Malicious code in schema-hermes-protractor-figures npm...

MAL-2025-143314 Malicious code in hermes-development-browserify-framework (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 603d2d8cb661d4bfb2a2f0cae3ab47d384a2ec9b7bd2980e68a0ee846b0d175c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149168 Malicious code in virgo-rehype-hermes-mui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b4c4bf9e0a867f395c0915acb3f132a13d802a1a26646349a3019eb4bfc537d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143306 Malicious code in hermes-chakra-ui-phenomic-mdx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13b33c27a1c1db0a48758f62868c7102a48a907afe4448ee7cf56dd1673ef0d1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...