MAL-2025-69263 Malicious code in main-moccasin-baboon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 973c9bcef0495fed11524b4d8ce2b8c43717c7bab6ef874b81a526bcc5a7ec52 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-68627 Malicious code in handicapped-blue-silverfish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b12ac73306fa2d1e9649e76448b3a58fc5920c68e06ea10108ed3b65c39b5db7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-62234 Malicious code in cici-enting14-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7d52a0ea53e71db97756ba6659e76a1ea0a45cbe34984d5c68cea1d00bee684 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-64514 Malicious code in nina-soto61-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba890843ec68ca21100136e0ff84b0af1c75b023132b01c116e34effa0131c4a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wibowo-empal36-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61eb922edced5ec29aa0c5e9fca4d2370a65e5680276300de334865801e3f60e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in indah-bubursumsum58-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e28a3b53846e6d01393f3317a3f982093d57a63e1a7510c6e0faf2bccb33c560 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mulyono-jus21-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 860167cf6ce094323f76e9aff17a999e854ce93e0310db5a9f8fb3ad2801a6f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-62890 Malicious code in fadhil-saguer1-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c6ffefa8c1e7ee59c3f49dff58462fb7331bd5a9a708815a0c5a9e067791f12 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in industrial_marsupial_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54c4a39bcf89f686e873a52d9ee9886fbb79578d519d059ca0e0627484f0f372 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-61393 Malicious code in strong_lemming_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 24bdce26e5efffcb64409354c045372bee1f8662260f6684589d8a8afd30afc0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nina-bika87-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2019b9136918310ddef2bdc00c5d3a3284775dc787641c9d1f3d436b0569c686 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fadhil-pecel67-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1766740f62b7ece6b8ed1b74e84e5104462b7fa2b1d739db70a34d5dd279db0f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-57129 Malicious code in kiki-empal87-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b255dc19f15d79e4a3b3611c133d24cf90241fa66cd521bca1a53e73c4dacd0e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious Package

Overview jito-shred-propo-excutor is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

MAL-2025-37963 Malicious code in usecase3 (npm)

The package usecase3 was found to contain malicious code...

MAL-2025-5174 Malicious code in worldhello (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c09616d1a3cf63c69efe5b81863fee024898fd16025a96efa3e70504012bb6bd The OpenSSF Package Analysis project identified 'worldhello' @ 1.0.0 pypi as malicious. It is considered malicious because: - The package execut...

MAL-2024-12110 Malicious code in precompiled-wasabi100 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38f3f008b27c846a21dc6b847a1e4a2f4f705d51e81983df2c63a7ef6484a365 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11863 Malicious code in 32red-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c7c76ac7d57265d4cc494b13ff1a0000ff8cbe225dea90e42a200545dd8359e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11800 Malicious code in yir-image-gen-asana-rce (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 050cc0b4f55e2e2b44e9eaeb0b6b269c8eab27bb007239d6fc7cb318e55f475d The OpenSSF Package Analysis project identified 'yir-image-gen-asana-rce' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

Malicious code in down-lo-ad-now-zip-mp3-7514-tapestry-fqgk2-jvvwtn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9e313ea5904ea6421f91d9c6bd2eec5d8a7571283640ee280aa882e8eb90fa44 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...