siddheshtea (=1.1.6) potentially affected by unknown CVE via manda-28 (=1.0.0)

manda-28 NPM version =1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on manda-28 and may be impacted: - siddheshtea =1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-159624...

Malicious code in manda-28 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce4500e1e683f508f01c74f0fe9148f84bb3b0aead480a3e1e6dbcf85f8e284a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...