EUVD-2025-112854

Malicious code in helmet-native-quito-capella npm...

MAL-2025-144714 Malicious code in markdown-prompts-pegasus-sirius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dda1fab30f9cdb224c6c52023b756f44b91b0d21d4e6f6436b9b8fe36f7b7a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145257 Malicious code in mysql-optimize-css-assets-webpack-plugin-castor-css-minimizer-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 550ccf08e3abaf7c172df12d438802d720d26d8c19209ea20c654059b77bd0d2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139264 Malicious code in airbnb-transform-apollo-terser-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 286babe43131b1bc5666a0fb2c46ea3d0a97b51b5aeee903c931463caf7e1f60 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143196 Malicious code in hapi-prompts-markdown-pdf-csrf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70611763ec0820cf06f80352089a3d6edd38c7a1491891daf9f0bd9f35c623fa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142205 Malicious code in eslint-config-postcss-loader-ignite-webdriver-mocha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4204c7bdbd78af14a75aad5eb09da611126c238cf10af0e8fcabcd3667cc3cc1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143989 Malicious code in jsonp-blitz-cordelia-less-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e9a2d48029e6469105d9d04046b04f81c2e0c08dcaad383e50ec9eb573552b9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143785 Malicious code in jabbah-nuxtjs-spica-loopback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14c6404a455bb29d3f9893290050e6e8982e6a5dbc7c9429a4f25827345da287 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146451 Malicious code in postgres-websockets-rocket-xerxes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dcdb7f97e93a2c4c9871540388ea14fb05fd1fde3053439339b3f20b7591e8a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149399 Malicious code in webpack-init-uninstall-rimraf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a6471c91382e04439bad5add4efea64590c4612d7a34a262d27a4609557ada3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142842 Malicious code in gatsby-exec-foundation-gulp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08aaa4659fe961e104e5a69e278baf5b0518eb53c8882b3de7b2bee0c88b2e8c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149171 Malicious code in virgo-sirius-prompts-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f02f8874cbbd0c3c9876281a2bbaa55a1e31356f32b7948983d1e797d2fbc0f3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140669 Malicious code in changelog-eris-apollo-cross-env (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 049d96747335ea7770993eb1f70fc96a4667abd33a8f58524be01f2c0992446b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145511 Malicious code in node-config-jasmine-sass-loader-mocha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71be3c59e0dfe748e4027f1079b928a11014eb9ed0dd0db124e3b57c425b16d8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144375 Malicious code in library-fornax-start-yaml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a6a2c4abb42f5f3186fb4734f53bb98dec2cb33af1fd697699823bbf6cfe4d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140303 Malicious code in callback-package-apollo-chariklo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 629e16768c84e6856bf6028a33cbfb8789a89d5023aad21cb7224dddd26e1eb1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145016 Malicious code in mira-polaris-forever-pino (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9839ca6c0ed2a3abb6097d7ab67e407b1aa3ab53b40751672e7c85aeabc8394a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140493 Malicious code in castor-rest-orbit-xml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 829f11bce1bd5202c40fe72edba2aeca19e4d77af75efa888c3d72fbdcb49c07 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141705 Malicious code in dotenv-csv-jekyll-soap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f602ea5a4d3e70788dc52fbd3fcfd4afcd27d68f5d379ce7818d10fa011db3b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146376 Malicious code in polaris-weywot-ganymede-start (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 170d3e04ad289a69b3ceb68f5917088fd708a09b8b96f4ab8261e3123b32e2ea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...