EUVD-2025-117206

Malicious code in new-salmon-gamefowl npm...

EUVD-2025-117207

Malicious code in new-azure-grouse npm...

Malicious code in new-azure-grouse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6da81101753f640bb6bb99ef7b9b99d6b8cff26989321016e680c4664214d631 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in riana-rojak3-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc8ebd7035c31c9b33ac4c9030f24fb3ad1eb5462d47cae6a90cf678105f7195 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-126663 Malicious code in galih-empal80-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e21b36d1ab115fad0b8a8d5d41e2a97d42e10e2284a40de96330c46396f01111 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-123836 Malicious code in umi-taiwan38-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27752239af322d74a42241b1212497c9563f4dbb64faec9a82628dc2a9286333 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-96232

Malicious code in newcamelz3n npm...

Malicious code in lutfi-brengkes56-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 338627755d4fd7192c96f0ff40a2f0ddc89442afc288ded2b2c200d14aa7e5cf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in absent_swordtail_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 676325c5ffd199c791aa15a7a5bd8384166e0f84c33ea343715a5d4e8cd0ef39 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-89884

Malicious code in newbatz3n npm...

MAL-2025-114351 Malicious code in gita-tomat87-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb5b887e23d441196222ab63e65d8d88a26dde558a1319649c82818c4a1ff274 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

zziplib: directory traversal in unzzip_cat in the bins/unzzipcat-mem.c

It was discovered that zziplib is vulnerable to a directory traversal flaw in most of its unzip binaries, including unzip-mem, unzzipcat-mem, unzzipcat-big, unzzipcat-mix, and unzzipcat-zip. An attacker may use this flaw to write files outside the intended target directory, overwriting existing...

MAL-2025-112013 Malicious code in independent_tortoise_crimson-57 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e5ceffac9acf6acb1db2e19a0aca361ace0e7cb3d5afaa771a518a35868e4ea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-78712

Malicious code in newmackerelz3n npm...

MAL-2025-106289 Malicious code in new_mackerel_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a527d3b468fdcc275d23d67c92277eb5d4a172689fa637b0cf2c5b6b7c74c04e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-81102

Malicious code in newcougar0xrequest npm...

EUVD-2025-81099

Malicious code in neworangutan0xrequest npm...

MAL-2025-99390 Malicious code in amazing_bison_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97842f4ff5d93a7a17199b3884112b7054c240274911d811aac1b3061c527a73 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hendra-ubi51-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0be0d559205f65d5e9002f51b459b562157e619d9ec6e139c8ccb64056e1883 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-101908 Malicious code in eka-keraktelor70-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 424cd84bc9c1d0e93e38ca8f8f780f0015cbeb4e66fb3f149d988194c88eb77a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...