Malicious code in amplitude-ma-ts (npm)

npm stealer. Hardcoded Discord webhook id 1497047226428690432 in postinstall Folder/bin/S.js. Exfils hostname, whoami, pwd, publicip api.ipify.org, /etc/hosts via Discord embed. v1.0.21 empty placeholder, v1.0.22 shipped payload — name-squat-then-poison. Typosquats @amplitude/ analytics scope...

MAL-2026-3028 Malicious code in amplitude-ma-ts (npm)

npm stealer. Hardcoded Discord webhook id 1497047226428690432 in postinstall Folder/bin/S.js. Exfils hostname, whoami, pwd, publicip api.ipify.org, /etc/hosts via Discord embed. v1.0.21 empty placeholder, v1.0.22 shipped payload — name-squat-then-poison. Typosquats @amplitude/ analytics scope...

EUVD-2025-143259

Malicious code in anita-manahudat-ma npm...

Malicious code in anita-manahuddat-ma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b3de13d54ba9842e6d52f3da49c6c944ccad04b31de8f5a2ad44f9ae82e6955 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-143022

Malicious code in buis-suninna-ma npm...

EUVD-2025-143256

Malicious code in anita-manahuddat-ma npm...

EUVD-2025-143255

Malicious code in anita-manhuat-ma npm...

EUVD-2025-143254

Malicious code in anita-manuat-ma npm...

EUVD-2025-143146

Malicious code in buis-manis-ma npm...

EUVD-2025-140276

Malicious code in miands-ma-nuru npm...

EUVD-2025-144454

Malicious code in hereis-ma-ta npm...

MAL-2025-160149 Malicious code in masako-ma-gunung (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c92d3a1b6ff70d760bec5f53ba28bb087419227a7503120d75b0f9e6d13af4b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ma-rasaaya-nurses (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb38a83e5a36ceb61bf8cebbdb056ebf8e0d4000d123a3c28b6d0c6331ad6e9a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in masako-ma-gunung (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c92d3a1b6ff70d760bec5f53ba28bb087419227a7503120d75b0f9e6d13af4b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in uaragifa-ma-sauuf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca8bfb9c48532d86ec4c14b1e631556f67952a4f222d95c1df5a61c4eef900fe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in uaragifa-ma-sfu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2ce72cb833aa70a4e533f84cddf331ff853fc05a8443952a6c3f25cab5f7eb4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-147282

Malicious code in uaragifa-ma-saf npm...

EUVD-2025-147281

Malicious code in uaragifa-ma-safu npm...

EUVD-2025-147280

Malicious code in uaragifa-ma-safufrat npm...

EUVD-2025-147278

Malicious code in uaragifa-ma-safurt npm...