MAL-2026-2281 Malicious code in roboats-addition (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f9c3e8c3efcca9a56765d765638b1f7a25769a8a94693c4f391804337be55fcf During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

Malicious code in anistream (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 57e4902ca2172a78b93acf6ec1413ab098e72c158dc1ab74c3a84f28f50382f1 Package hides code that downloads and runs malware, likely an infostealer. The code is not directly called in the package suggesting it's a dependency or next...

K000159707: NPM vulnerability CVE-2025-59145

Security Advisory Description color-name is a JSON with CSS color names. On 8 September 2025, an npm publishing account for color-name was taken over after a phishing attack. Version 2.0.1 was published, functionally identical to the previous patch version, but with a malware payload added...

`sha-rst` was removed from crates.io for malicious code

This crate was used as a dependency by finchclirust and finch-rst and contained a malware payload to exfiltrate credentials. The malicious crate had 1 version published on 2025-12-08 and had been downloaded 22 times. Other than the other crates above that were part of the attack, no other crates...

PT-2025-54755

This crate was used as a dependency by finch cli rust and finch-rst and contained a malware payload to exfiltrate credentials. The malicious crate had 1 version published on 2025-12-08 and had been downloaded 22 times. Other than the other crates above that were part of the attack, no other crate...

MAL-2025-188879 Malicious code in prosthetics-leda-mantle-deimos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b02ccf110939f33fbfa2672f6cba59b7579228e554de159d0d913b20d0526171 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186694 Malicious code in elara-hexo-postgres-astrochemistry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4068ecfde3f050b2eb3b2da7f67d43a1e892a4a4b0f4124c4635ec96c99f44ce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185200 Malicious code in sonic-os-afisigaafoa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd5f828fb8cdb811ae8ed2b9e4dc1bf718b7b70d3bf5a29df399152c0f4b8db7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lomi-fus-uga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7f461f247f76b7a3ddfa88fd0899201795776834054eaa8aae013f6ae95c911 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-183698 Malicious code in manu-oi-gsisofai01 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15e8a471912b33b6e4113f390d5ffa2f3bfd3d57e4635eec9141c9a56c1d1247 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-179937 Malicious code in lookingan-nanakila120 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4e4f19be8bdef8d85135022dfbb8d785e27d9471f3cd89d51f873e9be23f96c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in polymer-id-doraema (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 552229e2f5e7b2dd80a5991ecce31289fd7eececa58ed576a47ff227a1659c55 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in godi-tua-in0dtdc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c86f2729f64e618a5238a55aa7ed18d00fcbc56490948b8f0bd9fd163edc6f6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in augis-pomdoui9r-mafodfna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5166450f59a28c40264c420bba5d07e1899a7a08020c3ac07b5e93fd136fbb4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-171717 Malicious code in pedrohenrique (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bc26c021e338605bf2684ef0008d77eecb814713a031774839ee4f7eaaa88a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in makani-aiba-ufiyvaga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3e6bf73fa730a8e399d039f80407f0d7681100d369e8bfef5fb867ca96a446d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in manurung-poke40 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce02fdc20886b38a4bfdda6b569852a813869100a6a868f3fb1fdadc667f65b6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in @miptaa02/mqwjsf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fe26b96d9a17242e214832f65bc4f2013bbaae6a21e1a1a5d4199a6c333a02f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155594 Malicious code in hafiz-38 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de459f8fff376905ad71637048adbe269f5d0ecf49b827be67c84b9403facdbc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-158869 Malicious code in lookingan-namalaka56 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b186052f297d99b07e506c34366153427b29e2fadc393c371a70a63cea12133c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...