MAL-2025-123836 Malicious code in umi-taiwan38-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27752239af322d74a42241b1212497c9563f4dbb64faec9a82628dc2a9286333 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-96232

Malicious code in newcamelz3n npm...

Malicious code in lutfi-brengkes56-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 338627755d4fd7192c96f0ff40a2f0ddc89442afc288ded2b2c200d14aa7e5cf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in absent_swordtail_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 676325c5ffd199c791aa15a7a5bd8384166e0f84c33ea343715a5d4e8cd0ef39 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-89884

Malicious code in newbatz3n npm...

MAL-2025-114351 Malicious code in gita-tomat87-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb5b887e23d441196222ab63e65d8d88a26dde558a1319649c82818c4a1ff274 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

zziplib: directory traversal in unzzip_cat in the bins/unzzipcat-mem.c

It was discovered that zziplib is vulnerable to a directory traversal flaw in most of its unzip binaries, including unzip-mem, unzzipcat-mem, unzzipcat-big, unzzipcat-mix, and unzzipcat-zip. An attacker may use this flaw to write files outside the intended target directory, overwriting existing...

MAL-2025-112013 Malicious code in independent_tortoise_crimson-57 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e5ceffac9acf6acb1db2e19a0aca361ace0e7cb3d5afaa771a518a35868e4ea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-78712

Malicious code in newmackerelz3n npm...

MAL-2025-106289 Malicious code in new_mackerel_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a527d3b468fdcc275d23d67c92277eb5d4a172689fa637b0cf2c5b6b7c74c04e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-81102

Malicious code in newcougar0xrequest npm...

EUVD-2025-81099

Malicious code in neworangutan0xrequest npm...

MAL-2025-99390 Malicious code in amazing_bison_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97842f4ff5d93a7a17199b3884112b7054c240274911d811aac1b3061c527a73 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hendra-ubi51-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0be0d559205f65d5e9002f51b459b562157e619d9ec6e139c8ccb64056e1883 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-101908 Malicious code in eka-keraktelor70-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 424cd84bc9c1d0e93e38ca8f8f780f0015cbeb4e66fb3f149d988194c88eb77a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-103283 Malicious code in global_iguana_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f8873e94eddc279365be00620333af06bafba7d11b10af5786d39f49f6d1d65 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-103561 Malicious code in hanafi-tahu68-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9506c3ca3b8ccb6e4fe327b4f5512447ac03c88de0558bcc749550d122dcea14 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lina-teh50-crottsekebon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0533c86e3a1ae349dd72f4ff776c0064bd002a2f5cd4f496c2d191492b1465e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sari-kupat21-wekto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 422f2fc7b088f8dc3e19ad10f2cd224800679b5020985d7d41a041ff1c7b6e25 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-87396 Malicious code in kresna-dradag29-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce4191dcdfb68b3da7d58aeaa384e7d99bbeceeee2d4d526de2e4fadff4a2824 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...