Malicious code in nutty_chicken_peach-87 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4c251ca57addc14e6a818941b9df2df607ccba089b727804f409f66763e6b06 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in following_worm_aquamarine-25 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d16261f0ee471a3bd1732609e5b854661a46a60253ea8d0687ebd9ddb2181ca4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111804 Malicious code in developed_swordfish_green-62 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82ed70876e0fb294c51323e1ca423a719a4c9ca6804f2f0b99cdde6d852d649d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-112014 Malicious code in indirect_warbler_scarlet-18 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8627c9e52b969ce498d00b9f3bcac65921a4f5f91f9017c41c66ecc1107a58 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111786 Malicious code in dark_chinchilla_indigo-29 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e9d5ba23ac756c5b1f8cb75ec10d20b3cc0f4f3b3aca2b06212946232aa6b16 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111704 Malicious code in breezy_dinosaur_aquamarine-43 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7960241780a1cb3b786d40103ff74b3cdc651b6c84aae82cb5942d784103834d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-112377 Malicious code in sweet_deer_yellow-85 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67072ab662f77110148cc0c1e376f2dfb4a5dac2fd80b9a96e7576e89365ad98 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-112022 Malicious code in instant_carp_blue-56 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 814b8cc80b08a2241897208d31f0967219eed21fc754eda6b4a053a9de4951ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xerothermic_toucan_amaranth-81 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b574a307ea432a2cacd013af1fbf0af6701e92012dd8fa0f5a6df71381e5a98a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in soft_cicada_harlequin-99 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 304655ae80864f227dcbb2d094d4b0279495a9990fca6b65af7bef2c2ae9b1a7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in shy_carp_coral-99 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 931a2a9824d3b75c21e49930460c954baebafcfb54f41c20aa4ab09166edb49b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in financial_llama_purple-44 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 208076eca32696fe87340d3596c0b028c07ad98c3a4d6b5fd6391667bbc5a1d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mean_mammal_chocolate-62 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3889521ab35d1f129407772baf9f5c5f08b018c4df92db74ce86eb1e9bc84b59 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

@abangkuro/bluu (1.1.8), @awee1233/bluu (>=1.1.5, <=1.1.6) +869 more potentially affected by unknown CVE via bluu (1.1.8)

bluu NPM version 1.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on bluu and may be impacted: - @abangkuro/bluu 1.1.8 - @awee1233/bluu =1.1.5, =1.1.6 - absentaspaquamarine-9 2.1.4 - absentjunglefowlemerald-72 2.4.1 - abstractorangutanaquamarine-80...

EUVD-2025-74273

Malicious code in secondarychickadeeamaranth-93 npm...

Malicious code in confidential_hyena_aquamarine-59 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7fa6876051c2ca2199417b9f28bffed66f2f2df85024bafe0d25def5acc9f18 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-74880

Malicious code in asleepbeetlecyan-97 npm...

MAL-2025-112469 Malicious code in whispering_moth_crimson-56 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec77cbfec95aaefdf6932d0848ed4a0dbe938a0793d0c67b1a71bed2a8e4ff4b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111821 Malicious code in distinctive_bonobo_green-36 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cca37629d6d3005eda704d9bb90ed1c6282d5b8c4c9e84d84dc7072d19a9fda This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in medical_lungfish_blush-7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd6af0ff2da23d28a9100dfb44e51bcb3240dd805c452977ca08c129cea4b2f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...