MAL-2025-188292 Malicious code in nightwatch-procyon-stream-docusaurus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e497e4e46a9d7a57d90c0c65f94d4cbb5d2a38b38ddbc06eec016cc45c40b6e4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-177500 Malicious code in poglymer-ognamoh-afiaai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6afb2fa45285e7bca408bc4ca27e352a554d1564579c6d775ecfa75eea2b0f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ican-poke32 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b952c7fdeafde2b724e4252c55e9621d07b3c70937952ac2d38e4b7c4d72194 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aciyua-idusut-dajuar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fd25f2fa435079c5f030b43f08bf139f8508efabb2a3f4fb503469db4960647 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155630 Malicious code in hafiz-poke25 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a3de0c0c7d6d42d1a1e8f128a27ce48a080df49bbd0352e751fcbb881e99c30 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149357 Malicious code in webdriver-mocha-miranda-virgo-hydra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8823687b1a4ad4db6d07e11c07334da46f31bbe82d7d061ccf946caafb16fd1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rough_wildebeest_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19108e27330f7983ea1c58606bfe8b88286db86f41acf90b79117985b4756a1f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in expected_canidae_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77fd1475cf7ce725b97bfa95629f2e66c90a4938b96b52222c1d923bf8124128 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fadhil-jengkol66-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 270591510e12ef8056d9c14bfb93cf840613bf75c0ca3d5798a6bf33b158392b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-112961 Malicious code in candra-gembus30-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b4030faa1a60dd73d91bf873b1dc87290ed5cb4843ca3f27d5a0747393eafe8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-102882 Malicious code in fortunate_tuna-toolteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acf0a819a82d584ca4f4b184b2adb0c57c75d4fde8a37aaf6eaf0ffeb38cba33 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-92747 Malicious code in yuni-serabi53-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e01720270f06879c5f1fdbc3d354d95b36c2a931fc74fe954cc2c116173a108 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in indirect_deer_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9875f083f2791f09d4ffbc50cf6262455db6dc48d36d57bae99d75bcdde65827 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-76543 Malicious code in zain-tahu29-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26acc8aa275eb2fd16c88a92c2b92bd55cb7cd7ff48495724e7a895ea8b050e3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zippy-green-cephalopod (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d05f8f36b1fffcdf735f5647f5a7d1820f1930fe804ce25391ab12205c086ef0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in unknown_stork_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7576e468e578f296e49978b034c666311de3f0761b602f5bd14d2a7f24ed35e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-59037

CVE-2025-59037 covers DuckDB npm packages where four Node.js packages were briefly compromised with malware: @duckdb/[email protected], @duckdb/[email protected], [email protected], and @duckdb/[email protected]. The malicious versions attempted to interfere with cryptocurrency transactions. DuckDB de...

Nimble 信任管理问题漏洞

Nimble is an open source package manager for the Nim programming language. Nimble before versions 1.2.10 and 1.4.4 suffers from a trust management issue vulnerability that can be exploited by an attacker to deliver a modified list of packages containing malware packages. If the package is install...