MAL-2025-151556 Malicious code in abu-poke46 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 823ba4b46dfdadb550cd21adfce2c7f2de662250c59dd95209e79d17995832ef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-153976 Malicious code in buta-sf-mews (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d1c9f49f5887fc5b9f18458be54c9e38888f15dff94c056ef6f93562ed433fb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-154056 Malicious code in cinta-28 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4fa2d7c1c0f9d4f6c49abd834316eca9ac82ecc0bf97841524b2febc9798c3e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155322 Malicious code in gifa-otau-umo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d967898c499a56420cef668d5d4ea3d311659b6ccc0b3fe2ae3b20ff64f38ee6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-157889 Malicious code in kupai-lukta-jol (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03857ae9573bede240db67e663ff44d1181a566b0922e4a3ad9d79445c72956a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-161910 Malicious code in nasrul-poke22 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae8f87fb95eb540d108fe64cf94de41c6312e2547c601922a67c610234529078 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-164199 Malicious code in pilka-luniu-kanjika (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b8746a9b15552bf9bd980f617ebb7a0f4e547d57b55ba6cf9776b228eac5ec0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-154687 Malicious code in dioago-kamoi-alaliaoki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1743a73800e532e5cb4c1cc067ed4e3954a75c4060b30daf7c692a0117b46145 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in manaf-assssin-muanst (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd820a46e6ab146a004d83418c9f5d93bf372279b318b5a9515cde0452ec455e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in muklis-47 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d53ffaf9a7eef73f47ceca1454e1772b7ef84b9ffdd39aefa0dea551a669c5b7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nokire-rara16 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfba69bae657a49329c55cd2adbc568c411bf703f7ee5b32346a55c8eccfa5bd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in avminah-fagmaas-adsia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 661767970d0a63a304553d8c2c7746c2968aff720978041ba643f2a7bcc2d563 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in billa-53 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39301e4026b4b3e12d6bfa1c0698f5b91fa2ee02e6e0a36d2adfffdc973891d8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nabuf-otgigaf-dofaji (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7a2f9f3ee0dcf77dad4d4ca2fb03ec6b1a499e71f24294929b46fa3c3b85b02 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

siddheshtea (1.1.6) potentially affected by unknown CVE via nudel-rae-naha (1.0.0)

nudel-rae-naha NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on nudel-rae-naha and may be impacted: - siddheshtea 1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-163699...

Malicious code in manurung-poke40 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce02fdc20886b38a4bfdda6b569852a813869100a6a868f3fb1fdadc667f65b6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

siddheshtea (1.1.6) potentially affected by unknown CVE via ruji-34 (1.0.0)

ruji-34 NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ruji-34 and may be impacted: - siddheshtea 1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-165260...

Malicious code in @mipta1/husada (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07b109c651e524c5b105d85798f362d052e5604037f9a592ede2beba8f979fd1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aji-poke44 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector babe48fcefc989db5d5bead361044609698799c441bffe048b24a1fb23a0288f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jeep-poke21 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0f18a3289fa860fa31464f3e375821ffbe198d5c5e8d4ac56f1a2e45b386dd3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...