MAL-2025-176150 Malicious code in miusafasdagan-nasduat-bis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd775a10e3c153091ef078521b8c311b0d427f847cc3e3759bb496b8a8b5d2fd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in laila-lapis29-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1a4f62c65b9c1b56f761bd97ab311d52e9900540ff7a2d3ece88613c574b0be This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xaver-mangga81-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c51719ad216ad82b37b79f0daff5dd8725e4e0fb48968f66fb53d81a0cd803b1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in likely_gamefowl_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 244b20979aa8afe1e8eeaaf6601d5a73d6a8be90561f4e977caffe1682c8e8ff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in social_smelt_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73cdf02e49e6d4375fb02f1fa4dc946d4023d237289ad4a9a42ed04ee8700deb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-96484 Malicious code in secret_firefly_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0754d19d5763775cd361b6d527a535122ede45da491ad2333e4dcc4a7b93503 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-59602 Malicious code in yanti-esdoger89-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0b76c92beabb58494e9d24f01200c9e3c893a5337765d58593857ab72d3dfde This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation.

...