MAL-2025-187320 Malicious code in helios-webdriver-mocha-superposition-phylogenetics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7fa52991d1dbcd2f6889af5503b80d384df7b867c03de23959b38644f8ce0cc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-171534 Malicious code in maevekelly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 376373d830b5b9c73f83e3fc78016edcc3c8c40456c4c8426452dc89a5af5a6a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rita-95 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f328c67bca3b3029d0f1cafeeafdb11f65ad7a12284137ac6c3b21c41ec0bbd4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-81367 Malicious code in siska-bakso49-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5153233312e18bea24571fd08683b8cafdc893b19d379f1b647e68dbd730540d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Candlepin: Re-enable manifest signature checking

Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests...