MAL-2025-105989 Malicious code in mtvtur-devapptea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 809683564ffca5815a118943be1d60256002402d8e285689943581acf57176bb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-106760 Malicious code in optimistic_turtle-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8308caa8444d2c1b1e847c7bd440c224e1e1b9b3f632b0dc38a8abdb941d7265 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-107400 Malicious code in psfdhg-devapptea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f14800e5944853e3fd00e4c0ca4260b92c6fbfd5625f203e8ee5b23d85d645ef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-110312 Malicious code in vague_lynx-appteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb9f22937d88e4eb2b0d8d1d0dad8673af17336c342ae18f03ca784628c70d52 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-109343 Malicious code in surprised_perch-silentdev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9e2f5ca8fcfc84e386b9b88c576776e654bf086cb6a48e3fbae20bf32e98ec6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-103593 Malicious code in happy_cow-appteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 242945ad481fb1f612ef721da7a8cb083411edf4a60f73750a4ea16cb737cc68 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111030 Malicious code in worthy_crane-notthedev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ff8225650fa8611e9ac6fd5a71f7a095d9251708af94dea79bf9e68b730faf5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in huethea-notthedevs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e2cb3fede06ad21fa6f889823e8628134c66e3c151e8939679331f76c0ab972 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-77442

Malicious code in attractivequeleamagenta-95 npm...

Malicious code in annual_jay_yellow-85 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fae6d3c91db2cafe7e0f96adb5d7f7c8024686efcedf0ffd5811b3fdba94c15 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-106000 Malicious code in multiple_louse_amber-24 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cff61593395d271159c64a4a4b6f805ff7d45d8eb4e9ab266272b9f27503ff04 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-103627 Malicious code in heavy_armadillo_aqua-64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3006bfe8f07e3f811ffc58211eff7f86b135c3b7476ca265741df5cd739c36c6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sad_pike_indigo-55 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a7619a6a2f34f6ee47d88cc5b14a0798e6da4944963adc8ed013e800373362e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in elegant_snail_blue-27 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b44eb350f1371d1127f57c0ee2cb1277dbe4d9eaf2b518c1d990a28019d54c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-105999 Malicious code in multiple_lemur_lime-94 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3befdc2f78e11ecbc902fc7b3061b7dd18422f212bef41ed1a14a021e109f4e4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-100076 Malicious code in brainy_planarian_blush-63 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2348c23d45b64888037dd0e601646fd14cfe7113e05daa487f52af864cf9c0aa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chronic_cow_coral-46 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 236aad0a8d99502528aa3aabed3468fff4c05cc45b5fcbaf0863d0f839f0507f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in progressive_lungfish_turquoise-24 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fe0e71cd3f97926e595023d5b5f0bd819a3a5957ecd0dd9c89149b6359b3179 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

@dokja/dokja (1.1.4), above_angelfish_peach-86 (3.1.4) +249 more potentially affected by unknown CVE via dokja (1.1.4)

dokja NPM version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on dokja and may be impacted: - @dokja/dokja 1.1.4 - aboveangelfishpeach-86 3.1.4 - abundanttickmaroon-44 3.1.3 - activesnakewhite-91 3.2.4 - adverseelkblush-92 3.1.1 -...

MAL-2025-100199 Malicious code in busy_carp_lime-96 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f7a38cadf10fb107b3eabb90c2e7fb1d10d233bdd55d4615d682dc274ef690f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...