EUVD-2025-111224

Malicious code in metalsmith-ultra-ceres-fomalhaut npm...

EUVD-2025-111238

Malicious code in metalsmith-graphql-pegasus-hermes npm...

Malicious code in metalsmith-elektra-fetch-event (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70ad4825d26657e1d808e320ba35d6115608876599dc6bf3bba69bae9ba3c742 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145949 Malicious code in parcel-auriga-express-metalsmith (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97e704fcb48a26e6e92d57e74702f29a59010b27f3610b7b864318db8bc6ccf7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144877 Malicious code in metalsmith-graphql-pegasus-hermes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f17541e872a174d77d0112b013ca7a42e843793669c3082e2c94fd27cdf7dfa4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140778 Malicious code in chromedriver-metalsmith-toml-nightwatch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 099a4ebf7ac7382de09ed462478b2c913c3b9a9bf86d0bb11b53ad48aa1a13c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140747 Malicious code in child-process-framework-metalsmith-celeste (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 849be0aae93e5cfbd3e6a735ee71094677ea146394d513afeaba71ce013d555d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142642 Malicious code in fornax-octans-grunt-metalsmith (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b602d370f1083a15d9a1ec3d3af5636eadc38249b8279136e2dfa493a1c039a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144887 Malicious code in metalsmith-polaris-browserify-zenith (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector efeca10eedd2868420a67a14a83dd8861e9350b5413837f1fac9c3e8496cc52e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144883 Malicious code in metalsmith-mui-less-loader-docusaurus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10bb6388df2ae8ef88d5d36c437f612beb5e1f332ee1c03c546e1444a4f4f673 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149795 Malicious code in yaml-meissa-metalsmith-hermes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4813c135c90f9f7d46aa55e10b0dc894ba8db0b83c98c60e70abb69347031ba1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147165 Malicious code in rehype-css-loader-metalsmith-carina (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fe2030d45e843d156fa16ca029b0f063d19d50a9ce988cc4c4a0fe0f2d6ac89 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148308 Malicious code in stop-winston-bulma-metalsmith (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09e6a3b48b1fa6a57f7a149b87c21c622de6c043358cb99a7e0448970c1f9783 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146472 Malicious code in prettier-nuxtjs-metalsmith-miranda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc0530eb1ad39700c42120f582e87d6140918e039de76026941107c4042d0a81 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-120180

Malicious code in xo-metalsmith-soap-yakutsk npm...

EUVD-2025-111219

Malicious code in metalsmith-yakutsk-juno-dagda npm...

EUVD-2025-121215

Malicious code in toml-indus-ophiuchus-metalsmith npm...

EUVD-2025-122994

Malicious code in quark-metalsmith-cypress-oauth npm...

EUVD-2025-124094

Malicious code in ophiuchus-metalsmith-apollo-fomalhaut npm...

Malicious code in quark-metalsmith-cypress-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18bfcb7cc1eb411b112fa6af69eaab7717479dc39cd47dbe110c5e2a84aa634c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...