MAL-2025-146987 Malicious code in quito-apollo-europa-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b4eb6051a4b9dbc341e909f1b7140e2b5d8827337159c41ee2252851b56fe9b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140377 Malicious code in canopus-xanadu-markdownlint-non-blocking (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac0db4becaf61d04f82a2b7159858b15dc737727a86bd0c3f376ed3aaaa44ce8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mongodb-semantic-release-elektra-delphinus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c718397129adb9c3c718f37bf5cecd57fc85c2c49618154e9f7ad5114f9696d8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-113868

Malicious code in eslint-plugin-spectron-csv-aether npm...

EUVD-2025-115144

Malicious code in commitlint-config-angular-global-dotenv-andromeda npm...

MAL-2025-144520 Malicious code in loglevel-run-script-cross-env-superagent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5274bbe00f3f0fdea25171e1d9b6e8028893566b13e1a05f6160aae69d26a73b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146507 Malicious code in prettier-stylelint-enif-ophiuchus-taurus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb1c36c7e8318e9c03ae9ff620c9c5629c7f9fa3229ad0c5cc87694ef5eae4c8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145886 Malicious code in ora-jekyll-nodejs-antd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c99ac7ea31cddaef6cbf34ea2f14a323c48b85e8610b6bcf49716db4c0d7a0c6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139088 Malicious code in uniform-emerald-dove (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 845e445dfa88ebac32dc00958705f6a5b81989911b474171c0e9bd428ee3a21c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138877 Malicious code in misleading-red-bear (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd494484dfd8d481213be418ca55214d411a83c445c5ade866277dc5fe6a7537 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in citra-otak-otak17-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e861f3033859743a7e33bb2db0798ba79f0120f1d9ec72d8d037d1b9ba11a325 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jaja-rangi95-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f4fb84ec95dbc5f74a38922aaec73b258130ac79b361e62e492c71fd6b38a64 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zain-tahu88-sumpek (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe5d35e99bf3b6fc02024d46b417f82496a3a625e451ca7f50b57d037bbe09c3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-131921 Malicious code in ade-sambalado10-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 714db63464f30b53a13473533860b6b4212e4d41652fffd9e558c19ceaeb9219 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ogi-ikan5-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a8649b2a1fd9bdded99a573b459ce9cf3c3110a70fb998617521c921fc602a9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in yanti-jus76-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c162a39ba4b4d63336ba381268b1f4bb9b13e4c11a719675fc4cdcbe7d53b4f4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in explicit_ostrich_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be6796f2973db648c6967ebbdd4f3a32155caf475704411820c25664db5820a6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-93390

Adobe Pass versions 3.7.3 and earlier are affected by an Incorrect Authorization vulnerability. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue requires user interaction in that a victim must install...

Malicious code in cici-ragi60-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c61d534404b6298faa410c72a45dbdea292875f3a21d04877dd55c27c44d11c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cognitive_canid_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e00247abc8ce946848d32ca39bc2a87ad6ebcf10f5a82e15b96db20512ed501 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...