@miftaikyy/rssosya (1.0.0), @miftaikyy/rssoya (1.0.0) potentially affected by unknown CVE via @miptaa02/vibas (1.1.4)

@miptaa02/vibas NPM version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on @miptaa02/vibas and may be impacted: - @miftaikyy/rssosya 1.0.0 - @miftaikyy/rssoya 1.0.0 Source cves: unknown CVE Source advisory: OSV:MAL-2025-151001...

MAL-2025-149911 Malicious code in @miftaikyy/rssosya (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3de59643cb3bfa319b374ca34e698ba13b18c91997a0732f2e66f0c3ad3c16f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...