@0xwork/connect (>=0.1.0 <=0.1.7), @agentholdings/agent-passport (>=0.1.0 <=0.1.5) +21 more potentially affected by unknown CVE via openclaw (>=2026.3.22 <=2026.4.5)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3, =0.1.0, =2026.3.25, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 and more Source cves: unknown CVE Source advisory: SNYK:JS-OPENCLAW-15989071...

5ug-cli (>=1.0.72 <=1.4.0), @343dev/optimizt (=6.0.0) +87 more potentially affected by CVE-2026-29074 via svgo (>=2.1.0 <=2.8.0)

svgo NPM version =2.1.0, =1.0.72, =1.1.2, =2.0.0, =0.0.2-0, =4.55.0, =2.12.3-canary.621.15219.0, =2.1.0, =2.1.0, =2.1.8, =5.0.0, =0.0.1, =2.7.4, =1.0.1, =1.3.9 and more Source cves: CVE-2026-29074 Source advisory: SNYK:JS-SVGO-15423912...

Malicious code in neptune-async-karma-repository (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac58492e423291f353f279ee514a101ef97ad2023b70a908cb71091c4390539f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187719 Malicious code in lacerta-chalk-ini-neptune (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45cf21208b56ae1d0da3be8ce48b148ac7f6247e8b2ee4ddf53e45b162060b7b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187053 Malicious code in frontend-uninstall-foundation-prettier (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 689a30b58745647f6d8ae54285da6f284047816f0b89c8c04d4a4e632d5b81e2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-179744 Malicious code in kiut-acg-avefivubug (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b8a7ab6f530f7639e392312915106e24d5b8eee01bb599f4a368c5703fde007 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-134517

Malicious code in kisut-afnig-akificfub npm...

MAL-2025-179520 Malicious code in anais-papmoa-0pia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 284c7c0f3318106daeffb0218424cd355124f9327f4af6dda3ab3ebd98f1ac05 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-177747 Malicious code in polymer-agiaga-afafafyag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 295afd1a492b54a4a3262a8f646b4d5190c524c707133cc666318929841494a0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-139727

Malicious code in nokire-tanjiro47 npm...

MAL-2025-173562 Malicious code in butanah-fipadsfha-hafuh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e41f33560ae9fc53a17900229229fe87796978994b04af4d34530068b0db0b4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in polymer-avoafifa-fagihagga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57c7cafaa7a85477da9b0e48baab46ff90348024815d00dfe4359a1ad43e8617 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-173790 Malicious code in butry-yust-nutrus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 538ec4857d649dd9f18c7a6ab62094eb12556516126280c0f6f98635ee5f409c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-172032 Malicious code in yudiputra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 273cf005fd4776f081cc0046ea49c3983c9f386484b30dfc1088eb310e0a3a09 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-165010 Malicious code in rival-poke29 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b1e4cfd0174d5252cf79fec5061077b2d20c7a117cde59de86de734a86238a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-159729 Malicious code in mansia-tavil-madfoi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcfb28a5456cf9aac5608d8438b4506ddcb66c588daf0d95cb21e2cffc5f0ac2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-157280 Malicious code in kamasada-natib-yalufar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0781e85e762b79e65b2a1f335c48da001e0f9564146ba51440b25b8912abd9e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-166868 Malicious code in teagood-cuekin98 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c0e4d6d3f17da78db200e649e2e1a8bf08fcd90144c7c405f112762e089e738 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-153208 Malicious code in avminah-fagmas-fgofagi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a98369333a089b7369c5e008c6f154d5110aa63d6fa9a024833d86e0cb68ecc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146641 Malicious code in promise-graphql-start-superagent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2289446017d83cf85ed806fb6e736a6f69f9e8d4e760a2daf3d238881af564bd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...