MAL-2025-138763 Malicious code in grotesque-orange-junglefowl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa6ab74ab7d8e00ba82151c88cd9af57b2afdc6fe6f0e2aa0e17c14e037533f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138844 Malicious code in lonely-emerald-mongoose (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d0039326b84e9139cfc3d916c40bf11f3e476dbfed30beddb7239571752ab10 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138837 Malicious code in liloyst (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1fc931892e1340a03042f91e1ca48d04171168fa64ec768aed1aa592f2efd6d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139008 Malicious code in silly-yellow-mammal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d25c191b131eb8816c89181add7c505c0adc612afdafc60365c2a6041d91b77 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in social-ivory-perch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4657d1a2ddb2cfa0424346680bc701aa074ca7ab6d0df7c4bffb602378373a20 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in curved-orange-thrush (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39ef8856f41d66e8d2bfd6b417060f717f920ce163201c6db6b71acdd9ab6f04 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139111 Malicious code in well-coffee-goose (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91de84200bbd114ea645aecc77a354960effd3153ba8d61e9a14b6cb58b5d9f4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138777 Malicious code in holy-aqua-antelope (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 24ae4df8a9f707910bba3600a9c4c168073fe696781efd8629e71a5a19e63c38 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in combative-crimson-deer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea20d6db67477fcb5b1856681f899c65c487c208feab659f676f57c06e0c1fef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in confident-ivory-marten (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b20b49e46658b478ed10f5a5edf28e215b005acd632f9fa7ddd4915512aa5aa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138670 Malicious code in dry-indigo-sole (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36dbf98e20619275027fd4151acecaf0ac913787eb11669176a745f6ee4bd1a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138992 Malicious code in scientific-crimson-bison (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c52f47ea463fc9d144ba747e222edcab1a5d0d703cb6530843365c73ef5c25b1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138669 Malicious code in dry-chocolate-parakeet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ce4ed9a19e46b14c01e8546d308d856477d11f62ee36d04d3ecb582b270bdfe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-42883

Migration Workbench DX Workbench in SAP NetWeaver Application Server for ABAP fails to trigger a malware scan when an attacker with administrative privileges uploads files to the application server. An attacker could leverage this and upload a malicious file into the system. This results in a low...

Pack-A-Mal: A Malware Analysis Framework for Open-Source Packages

The increasingly sophisticated environment in which attackers operate makes software security an even greater challenge in open-source projects, where malicious packages are prevalent. Static analysis tools, such as Malcontent, are highly useful but are often incapable of dealing with obfuscated...

Malicious code in smiling_eel_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6240c3ffaffc456b64be3d9f29dcc71a5aca779f67510c8ccb21f9554823d07e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fauzi-gulai20-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 455ede30455c9faa2a52be0f76e5963488607cb2a1eddfed57c0481440d11eb7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vina-kue41-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c7665b654f95183cf1f4439b7ded5dae6cbe213e346d01ec58070dc3d9d6f75 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tuti-sambel96-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2056f0a501095e28f2252fa20c8dcb947b0e5082d861b9c6c34354ffc7e9a58 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lina-sego96-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29be1c8cb0a7d25bb56f732ece112daf525855af406b3cb4e0cc7c7a09153b3f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...