EUVD-2025-112856

Malicious code in helmet-mysql-auriga-elektra npm...

Malicious code in fusion-umbra-farout-unuk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2276a1acac285c4c61c33b38733d0141742a73f31ba16f4d787ec835a352f2d9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-123478

Malicious code in postgres-perseus-karma-tool npm...

Malicious code in gatsby-vulcan-lacerta-alphard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ee152af5e0dcc5068bfc21b3ba72197064d1a82c2e97851c04f94b589799f52 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sync-jsonp-less-iota (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01ef6cedcae0b8171fc191b67ad90dfebd8ac6e394c7ce662b8e558b22e9d56b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144007 Malicious code in jsonp-sagitta-proxima-adonis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa753953218b29386b71fd301e0f77b7ee751f4c3fe229d8ada58d8b4905b054 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142126 Malicious code in equinox-meissa-europa-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 971426dab5e1c8b4d75b97a1da56d0a5d22b1e299d60a76669042d42416a363e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149617 Malicious code in xanthus-achernar-xenon-chalk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0307a9e41a3fb63fd942f96def2c8064a5c7e35505d8b5e4a2d76d15a67fcfdf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139233 Malicious code in aether-link-request-promise (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cd2a6fbdd0fd2a3975dbf408d242fa7675a68209e8547ca050aaf6e2ae6ac19 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142216 Malicious code in eslint-element-ui-buffer-figures (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a508dc44f6b649dc11aea2adfd3e0733d721a23e86034b25f378d3064b31a59 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145759 Malicious code in oberon-xenos-process-spawn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e025f47c913177a7992cfaf90cc9e7fb5b31a0018e27e73399b2e5c34a67df0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149678 Malicious code in xenos-gridsome-quito-chakra-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0eb64db054ad50159c2aa8b92655c222fcae4a6789e512b97c9f29c9f9bffdd2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144039 Malicious code in juno-style-loader-sedna-janus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bb1edc4673f0ed82d4bb87c438df25a1a79f430859c6849eac0dc14a34c4644 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142632 Malicious code in fornax-loopback-google-selenium (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1453791ccec0e6d9af3bb03731b15537c00689db44a6584eef16befedb6d447c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140449 Malicious code in carpo-mira-restart-cypress (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f1338397dbe4e92f39d3c40c186591ae1ad77a9bfd7a198bac2c4fd27af7e98 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143599 Malicious code in ini-pulsar-cross-env-quantum (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d11b83b7b486a7b785fa8426815688523e53e042c439819d5cd230612dd8d5f8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144870 Malicious code in metalsmith-arcturus-chakra-ui-fomalhaut (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e328f01f93a5d5887cc6910c54acc8b4c6ad9adc906fd77d0ea49a19e5caa52f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139946 Malicious code in bellatrix-nightmare-sequelize-materialize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4033e737930db4590403436f3a88cf32ddbe9c9595679fd09ecad8b2346f17aa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148781 Malicious code in transport-commitlint-callback-andromeda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f807ba3959fb8ddea8aadf86e62f2917a3c17d64df2cc7a46f80fb9868c3d97c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in javascript-nconf-ursa-promise (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec6c388d4d528181105b95e70ffbfcdb98a70dc29eecadcf4e7ffbd9fc7966bf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...