MAL-2025-111786 Malicious code in dark_chinchilla_indigo-29 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e9d5ba23ac756c5b1f8cb75ec10d20b3cc0f4f3b3aca2b06212946232aa6b16 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111779 Malicious code in curved_urial_lavender-23 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64c83216d981a841de6e0e8e5b3dca29059bbf895237955768d731c48b9b26c9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-112014 Malicious code in indirect_warbler_scarlet-18 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8627c9e52b969ce498d00b9f3bcac65921a4f5f91f9017c41c66ecc1107a58 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111961 Malicious code in handicapped_whippet_tomato-57 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5312a143a2874ce99bda8b40cc47890b3505c2412fb8a4496e6ad464495c4a59 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-112110 Malicious code in modern_heron_azure-60 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc5227543fd581a3c36d3fcd61a4859f4d00ad5b0e8aaa68a760cc3e6a127d11 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-112022 Malicious code in instant_carp_blue-56 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 814b8cc80b08a2241897208d31f0967219eed21fc754eda6b4a053a9de4951ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

@abangkuro/bluu (1.1.8), @awee1233/bluu (>=1.1.5, <=1.1.6) +869 more potentially affected by unknown CVE via bluu (1.1.8)

bluu NPM version 1.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on bluu and may be impacted: - @abangkuro/bluu 1.1.8 - @awee1233/bluu =1.1.5, =1.1.6 - absentaspaquamarine-9 2.1.4 - absentjunglefowlemerald-72 2.4.1 - abstractorangutanaquamarine-80...

Malicious code in shy_carp_coral-99 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 931a2a9824d3b75c21e49930460c954baebafcfb54f41c20aa4ab09166edb49b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in financial_llama_purple-44 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 208076eca32696fe87340d3596c0b028c07ad98c3a4d6b5fd6391667bbc5a1d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in soft_cicada_harlequin-99 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 304655ae80864f227dcbb2d094d4b0279495a9990fca6b65af7bef2c2ae9b1a7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-74880

Malicious code in asleepbeetlecyan-97 npm...

Malicious code in confidential_hyena_aquamarine-59 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7fa6876051c2ca2199417b9f28bffed66f2f2df85024bafe0d25def5acc9f18 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bottom_fowl_blush-39 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f0e2799a2dbc5d9c557e480074764e0953c04397fd4a2524c18909bb18f2025 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in southern_cheetah_harlequin-58 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 564b1cff2590ee033dd1704ed1efe01deb4cba220568f73a122339387afc2e81 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in medical_lungfish_blush-7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd6af0ff2da23d28a9100dfb44e51bcb3240dd805c452977ca08c129cea4b2f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mean_mammal_chocolate-62 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3889521ab35d1f129407772baf9f5c5f08b018c4df92db74ce86eb1e9bc84b59 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-74597

Malicious code in grandcuckooamethyst-49 npm...

Malicious code in organisational_hamster_magenta-20 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ab9164ab1f5edb109890c561ae02247b17c0fac1fd211bdab05e81096201170 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ytterbic_toucan_blue-98 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e5401f5ce0e0cbe03c00e78610e26a954e2aece325fa9abde81ea4b1d2a8f1c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xerothermic_toucan_amaranth-81 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b574a307ea432a2cacd013af1fbf0af6701e92012dd8fa0f5a6df71381e5a98a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...