EUVD-2025-177873

Malicious code in metalsmith-postcss-loader-magellan-test npm...

EUVD-2025-177644

Malicious code in nestjs-css-loader-command-mensa npm...

EUVD-2025-178474

Malicious code in hyperion-build-style-loader-lynx npm...

EUVD-2025-178549

Malicious code in hercules-css-loader-restart-eslint-plugin npm...

MAL-2025-187487 Malicious code in inquirer-flare-sass-loader-tectonic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a9ac73491da4c0bbc3063c9fee7d300beb6e658c1d0164abc26edafd86238d1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-179961

Malicious code in buffer-css-loader-draco-sirius npm...

EUVD-2025-178426

Malicious code in indus-coronalmassejection-sass-loader-virgo npm...

Malicious code in less-loader-grus-void-biosignature (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99eb889dc1cf69b2085a517f688f0af0a888445aef6063056bcdef36537a018d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chakra-ui-sadr-yaml-less-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a073ff2d6f60d319212474b26295e2faeab06927317a907039f5600ac134ae0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in quark-eslint-config-materialize-css-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f14e76d31b688dacef1a496176a9ca1ea81b594b81b2373404d54a5de86a60df This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-177670

Malicious code in neptune-barnard-mdx-less-loader npm...

EUVD-2025-176522

Malicious code in sass-loader-cluster-link-jekyll npm...

EUVD-2025-176523

Malicious code in sass-loader-castor-prettier-stylelint-lint npm...

EUVD-2025-179473

Malicious code in csrf-eslint-config-futurology-sass-loader npm...

Malicious code in nodemon-css-loader-husky-parcel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef0c6f6980a8e239fba86b499d7e58efed539940a9b4a001da5150da2f24d7b7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in perturbation-css-loader-loopback-uninstall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4684aaffab6d34720deb56993688e53726878270ceb84edaa6fe301f400e81a4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-178124

Malicious code in less-loader-rocket-adonis-kronos npm...

Malicious code in graviton-hapi-less-loader-electron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8bb8fb65ea2c82a7ebd036fb556fb70c2c9cb967106c4ea3b82b1936b540d8b1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in development-postcss-loader-webpack-cosmicweb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdc7d279a0f29b5bca794be3e6921a4e2c28a76db57e85d79fa4f0cca9313cb2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186415 Malicious code in css-loader-iota-celeste-electron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1a6b13fa0fe3ce78be3d5056c24ebef487000d78e816da9cf71322e731db798 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...