Malicious code in secure-old-deploy-resolve-encode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector edd40e8463e8ef60e60e2f721f62d52e42e5b10ad7481073017d47ad4d0616fa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189387 Malicious code in scripts-hermes-pulsar-neuromorphic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c868f2b930f8cef33f4482af086921d64684fe465c818ac9af2b1f199e0a258 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-178748 Malicious code in tanabufir-softafai-dubuatgifa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 062528bd0fe362ff7b3815e2ddd794e5ed742a5f4d3aeb380a802f9f14113831 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155454 Malicious code in guras-nutra-nuyi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14191cf20bfc55c6b3a5a09088f42c69165bff7abf9a2a2cbdab6d9a66bdb684 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147729 Malicious code in scripts-equinox-achernar-init (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75261065f0a6b02ca3e374fc44540af758f88fa9649ec332f7b2c9b4b226f83d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146737 Malicious code in proxima-scripts-wezen-slidev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5276ed126e2063e64fb1b6332fed4302d4454bc508f04b29c7812df1983b202e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in scripts-sadr-parcel-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39d4129ff9bff98bbff961f993a0ce01ca0fe2ec0098fc4f27ecfb22382b00c2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hissing_antlion_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd4be41fd3c2c1842edfb8f6fb52f5c2040fe9b5167bb8bb9eec5c6caa45dd06 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-117639 Malicious code in umi-lapis46-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59a47570fb65d63e7bfa64c1752cbb7df48c2f89ffe8b5183f8bc9803e9a46cd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-116270 Malicious code in oktafian-lumpur45-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66024982217ef3ba8f7f527bcbe0969f91ad74d37493ac1e9fa01245a06deb20 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-89117 Malicious code in ogi-rujaksoto7-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5fa442d740d78f2eab2c4056b87fc15a070abb3dada23afbef21dd5a7dc5d19 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-76723 Malicious code in ade-naget60-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1e622259f4221b15a3317201b7c18f314a001b1cd3f5bb62236decf28106d6b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-76564 Malicious code in zaki-gudeg82-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b6955507a1e9dcf495134075f3126c5f8d60f2586a26c05536f077d9b107e37 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-66658 Malicious code in administrative-black-swordfish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01f1e4954bfa2700db10200c4386536e411a3aa9de21a23a49af95b93ab7a9d1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-54414 Malicious code in putri-rendang50-kyuki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 061e4e5c079bee57ceabdd6292daab1e8b9d2824e0b3b26a8c12ecc87260662e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2024-1492

Malicious code in bioql PyPI...

Malicious code in ca-npm-scripts (npm)

The package ca-npm-scripts was found to contain malicious code...

MAL-2025-16415 Malicious code in ca-npm-scripts (npm)

The package ca-npm-scripts was found to contain malicious code...

Uptime Kuma vulnerable to authenticated remote code execution via malicious plugin installation

Summary Installation of a maliciously crafted plugin allows for remote code execution by an authenticated attacker. Details Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is currently disabled in the web interface, but the corresponding AP...

Malicious code in node-common-npm-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02090694bde3634ac057c9ea4e4f37e4f65c597af5c1490bbe56a25e7acb8031 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...