MAL-2025-117289 Malicious code in surya-nasisayur84-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc2a61e270050702db0ac95efea7ab6b28e92aab354f831bc1a61c85b6cd8a61 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-113538 Malicious code in eka-peyek57-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d37612bfbd8083d27a532d23d5f6bdc97c0e86cf5f2a86af9c84a41a7c105022 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-113998 Malicious code in fitri-enting43-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21635d7fdddb67c37194868909ea736a64d43604005ddb7a92bda617843cf9c1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-116633 Malicious code in qori-sasag25-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92e6b1730cd855be1b93fdab2fa325b341c6111ce8cea80566579d18d13f4fdd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-114929 Malicious code in iwan-mieayam82-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa7760ad8e5fcbae0e2b9a809b67a128f648e5c995aff57a75bc47936aff2934 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CISO's Expert Guide To AI Supply Chain Attacks

AI-enabled supply chain attacks jumped 156% last year. Discover why traditional defenses are failing and what CISOs must do now to protect their organizations. Download the full CISO’s expert guide to AI Supply chain attacks here. TL;DR AI-enabled supply chain attacks are exploding in scale and...

Npm Package Targeting GitHub-Owned Repositories Flagged as Red Team Exercise

Cybersecurity researchers have discovered a malicious npm package named "@acitons/artifact" that typosquats the legitimate "@actions/artifact" package with the intent to target GitHub-owned repositories. "We think the intent was to have this script execute during a build of a GitHub-owned...

Malicious code in imaginative_impala_pink-64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d40ddbe379c47bb0c4d67f42ca72d7c1b8620af6fc4b3eb744c338379310c76 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in silly_cockroach_orange-52 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bef2a73bef34df68b9995395cd16a483bde504a625984ac47bcee2537e6fe28b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nutty_chicken_peach-87 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4c251ca57addc14e6a818941b9df2df607ccba089b727804f409f66763e6b06 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in safe_roadrunner_tomato-80 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb1442ee5f7daa17ac5f6ed372791075b69a5c03c45c4a392af5cff06b5c5135 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in following_worm_aquamarine-25 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d16261f0ee471a3bd1732609e5b854661a46a60253ea8d0687ebd9ddb2181ca4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-74572

Malicious code in hollowmeerkattan-52 npm...

Malicious code in spectacular_spider_magenta-98 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b02d5ef189199218d9d8bceae9530ff0ecf885f357c22427b3436e199c732895 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111786 Malicious code in dark_chinchilla_indigo-29 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e9d5ba23ac756c5b1f8cb75ec10d20b3cc0f4f3b3aca2b06212946232aa6b16 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-112110 Malicious code in modern_heron_azure-60 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc5227543fd581a3c36d3fcd61a4859f4d00ad5b0e8aaa68a760cc3e6a127d11 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-112014 Malicious code in indirect_warbler_scarlet-18 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8627c9e52b969ce498d00b9f3bcac65921a4f5f91f9017c41c66ecc1107a58 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-112377 Malicious code in sweet_deer_yellow-85 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67072ab662f77110148cc0c1e376f2dfb4a5dac2fd80b9a96e7576e89365ad98 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111804 Malicious code in developed_swordfish_green-62 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82ed70876e0fb294c51323e1ca423a719a4c9ca6804f2f0b99cdde6d852d649d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111704 Malicious code in breezy_dinosaur_aquamarine-43 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7960241780a1cb3b786d40103ff74b3cdc651b6c84aae82cb5942d784103834d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...