MAL-2025-117745 Malicious code in utomo-sambel91-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b22e11bee8f13d491dd536d8561c9ce6e4a468378c92efc49da621357e74d2ae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-117123 Malicious code in siska-mangut60-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89ca5bbe77ab31d3a221b10efc8a56623a94cd91b1dadc571afe3e8d341c8bb0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-117001 Malicious code in secret_gecko_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c95a80a231f66c21a44fcfd821de75d30ed7df70dbd4733db88ced3df63036c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-112961 Malicious code in candra-gembus30-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b4030faa1a60dd73d91bf873b1dc87290ed5cb4843ca3f27d5a0747393eafe8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-117585 Malicious code in udin-kue46-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c6cb566f46ffee88cde2079c0bac55d880883e26849d0cec185151d3bd6a199 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-117306 Malicious code in surya-soto82-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a59093b3a9b74c8cdedec33b18c1fb697de5ca84550dd3e764c75aa879bdf98c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-117032 Malicious code in shrill_tiglon_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf9fd6a33bf25bfdebb3d64ac77e4621efb6fd365895f121d841fee34396beeb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wawan-rangi51-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07f88f382ef9b56a3f2cd3966e7e7ad766a869bd29b69bbb732d30149c013fff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CISO's Expert Guide To AI Supply Chain Attacks

AI-enabled supply chain attacks jumped 156% last year. Discover why traditional defenses are failing and what CISOs must do now to protect their organizations. Download the full CISO’s expert guide to AI Supply chain attacks here. TL;DR AI-enabled supply chain attacks are exploding in scale and...

Npm Package Targeting GitHub-Owned Repositories Flagged as Red Team Exercise

Cybersecurity researchers have discovered a malicious npm package named "@acitons/artifact" that typosquats the legitimate "@actions/artifact" package with the intent to target GitHub-owned repositories. "We think the intent was to have this script execute during a build of a GitHub-owned...

Malicious code in safe_roadrunner_tomato-80 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb1442ee5f7daa17ac5f6ed372791075b69a5c03c45c4a392af5cff06b5c5135 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111961 Malicious code in handicapped_whippet_tomato-57 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5312a143a2874ce99bda8b40cc47890b3505c2412fb8a4496e6ad464495c4a59 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-112110 Malicious code in modern_heron_azure-60 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc5227543fd581a3c36d3fcd61a4859f4d00ad5b0e8aaa68a760cc3e6a127d11 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-112314 Malicious code in slight_reptile_salmon-80 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf0bfb1d9929c6148a9df845d6eceb84467129fff3b073108e44279222a74ce0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in silly_cockroach_orange-52 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bef2a73bef34df68b9995395cd16a483bde504a625984ac47bcee2537e6fe28b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-74572

Malicious code in hollowmeerkattan-52 npm...

MAL-2025-111787 Malicious code in dark_quail_apricot-38 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0309e6febce7225fd52559c5db9311a3f2e381127af9b7d036dc9a8a4cb4607 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111779 Malicious code in curved_urial_lavender-23 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64c83216d981a841de6e0e8e5b3dca29059bbf895237955768d731c48b9b26c9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in imaginative_impala_pink-64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d40ddbe379c47bb0c4d67f42ca72d7c1b8620af6fc4b3eb744c338379310c76 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spectacular_spider_magenta-98 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b02d5ef189199218d9d8bceae9530ff0ecf885f357c22427b3436e199c732895 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...