MAL-2025-113998 Malicious code in fitri-enting43-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21635d7fdddb67c37194868909ea736a64d43604005ddb7a92bda617843cf9c1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-116312 Malicious code in oral_tick_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c459b28a53030a382503b2b5452fc7a2b78ea0872167d6657f44018e4d47ed6f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-116633 Malicious code in qori-sasag25-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92e6b1730cd855be1b93fdab2fa325b341c6111ce8cea80566579d18d13f4fdd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-114223 Malicious code in gilang-soto84-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d4d14814c8c2cff231a6f23b959e5bb883a8765ac53348f03bba11dae16db40 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-113319 Malicious code in dewanto-mie29-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6df99eb037a10780c843b35468a6befc26ed6697847b4f7495fe5baa72a9b23e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-118058 Malicious code in well_muskox_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7489e49d2d822fd5a50638957f3727cd9b548ab454a06ee4c89edf46b7879af7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CISO's Expert Guide To AI Supply Chain Attacks

AI-enabled supply chain attacks jumped 156% last year. Discover why traditional defenses are failing and what CISOs must do now to protect their organizations. Download the full CISO’s expert guide to AI Supply chain attacks here. TL;DR AI-enabled supply chain attacks are exploding in scale and...

Npm Package Targeting GitHub-Owned Repositories Flagged as Red Team Exercise

Cybersecurity researchers have discovered a malicious npm package named "@acitons/artifact" that typosquats the legitimate "@actions/artifact" package with the intent to target GitHub-owned repositories. "We think the intent was to have this script execute during a build of a GitHub-owned...

Malicious code in imaginative_impala_pink-64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d40ddbe379c47bb0c4d67f42ca72d7c1b8620af6fc4b3eb744c338379310c76 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in silly_cockroach_orange-52 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bef2a73bef34df68b9995395cd16a483bde504a625984ac47bcee2537e6fe28b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nutty_chicken_peach-87 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4c251ca57addc14e6a818941b9df2df607ccba089b727804f409f66763e6b06 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in safe_roadrunner_tomato-80 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb1442ee5f7daa17ac5f6ed372791075b69a5c03c45c4a392af5cff06b5c5135 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in following_worm_aquamarine-25 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d16261f0ee471a3bd1732609e5b854661a46a60253ea8d0687ebd9ddb2181ca4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-74572

Malicious code in hollowmeerkattan-52 npm...

Malicious code in spectacular_spider_magenta-98 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b02d5ef189199218d9d8bceae9530ff0ecf885f357c22427b3436e199c732895 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111779 Malicious code in curved_urial_lavender-23 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64c83216d981a841de6e0e8e5b3dca29059bbf895237955768d731c48b9b26c9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-112377 Malicious code in sweet_deer_yellow-85 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67072ab662f77110148cc0c1e376f2dfb4a5dac2fd80b9a96e7576e89365ad98 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-112014 Malicious code in indirect_warbler_scarlet-18 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8627c9e52b969ce498d00b9f3bcac65921a4f5f91f9017c41c66ecc1107a58 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-112022 Malicious code in instant_carp_blue-56 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 814b8cc80b08a2241897208d31f0967219eed21fc754eda6b4a053a9de4951ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111961 Malicious code in handicapped_whippet_tomato-57 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5312a143a2874ce99bda8b40cc47890b3505c2412fb8a4496e6ad464495c4a59 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...