MAL-2025-139111 Malicious code in well-coffee-goose (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91de84200bbd114ea645aecc77a354960effd3153ba8d61e9a14b6cb58b5d9f4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138670 Malicious code in dry-indigo-sole (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36dbf98e20619275027fd4151acecaf0ac913787eb11669176a745f6ee4bd1a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138669 Malicious code in dry-chocolate-parakeet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ce4ed9a19e46b14c01e8546d308d856477d11f62ee36d04d3ecb582b270bdfe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-42883

Migration Workbench DX Workbench in SAP NetWeaver Application Server for ABAP fails to trigger a malware scan when an attacker with administrative privileges uploads files to the application server. An attacker could leverage this and upload a malicious file into the system. This results in a low...

Pack-A-Mal: A Malware Analysis Framework for Open-Source Packages

The increasingly sophisticated environment in which attackers operate makes software security an even greater challenge in open-source projects, where malicious packages are prevalent. Static analysis tools, such as Malcontent, are highly useful but are often incapable of dealing with obfuscated...

Malicious code in expected_canidae_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77fd1475cf7ce725b97bfa95629f2e66c90a4938b96b52222c1d923bf8124128 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kiki-ikan26-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5ddc5ce8134cbda9dd9d3ec5842f9c5ec74be9ca4feee704f74e2acf4ad1d10 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eka-mieayam56-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f45f4bc16cbd87bda5c349309fbee2c6c57c7558c6e208e09ea001ddce91c50 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lina-sego96-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29be1c8cb0a7d25bb56f732ece112daf525855af406b3cb4e0cc7c7a09153b3f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tuti-sambel96-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2056f0a501095e28f2252fa20c8dcb947b0e5082d861b9c6c34354ffc7e9a58 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hadi-rangi55-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5100d2c6784900280e50d4bfcabe4728c37a6779baadcc37de5895ef341aebd1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sinta-bakso21-sumpek (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eaae09aee2e6335b2898573767fa35434255d7d87525e6d349db3f65e02f5d16 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fauzi-gulai20-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 455ede30455c9faa2a52be0f76e5963488607cb2a1eddfed57c0481440d11eb7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vina-kue41-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c7665b654f95183cf1f4439b7ded5dae6cbe213e346d01ec58070dc3d9d6f75 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in putri-brengkes20-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 859df9f13e2ae7e1459889e891a5f8672987de76341967900df66cfd1511d413 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jaja-bakwan94-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65a1148d09f7ba4a1378cbd4a839525f55145c288194bbd4a5fda92092441af3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rising_bee_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45b96138f51cf3ec4b6e7701ba48558e08bbe348729a2d395a32c044213190c2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in okta-keraktelor67-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69070965056546d2591a01db2fb1a18b3b77437c8d5c48cef398ea2960b21265 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hadianto-tek84-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7a1c253578c15f92422cbd6615aaae12194074615e0fb4856bf693bb9a77b01 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in maman-rujak92-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d6f3c8eb581ec8e3163c80a045207ecc271b2b6b04750441d7aff454a627a26 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...