Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

MAL-2026-3650 Malicious code in microsoft-applicationinsights-common (npm)

Two malicious npm packages published by the micresoft account typosquatting "microsoft" are part of a coordinated supply chain attack sharing identical infrastructure with packages published by the superbase account. Each package bundles a 4.5 MB statically-linked, UPX-packed ELF binary at...

MAL-2026-2269 Malicious code in claude-lite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3a73f0745200bef9d517a2ac5e3e69189347e0b730a0187e71c3c201accd5833 Clones of legitimate libraries with malicious modifications intended to download malicious remote code. The remote script allows executing arbitrary files...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

MAL-2025-188349 Malicious code in notify-string-deploy-file-private (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 261bf5701f54f586ce80f4a7f1529d9420634df6bbed2f132ab18fb20a29fa54 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-184092 Malicious code in mlokok-lfki-hakumajiausubi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7acca2e524d32626d2fc84ea7b162a842d20f4683996132407e7a05c6e59af6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185027 Malicious code in sonic-kos-fgiafao (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8272ddaf144809d894182063c1348b143529b10c241b2ad070cf5805fc689fca This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in baso89 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08531dd6386f4b370db1bfa2bbb50da4539c83cb1d4d2686b7a729bbc4109195 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-176883 Malicious code in nuragi-sutafia-dagiug (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2b8f6d968dcfa45e30a31c086fd25798f3a57123f840bcdc4681c74195dfa8f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-178312 Malicious code in riya-31 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d81629a108c1c22751904c02fdca540020590588011d855c481b9775f8a2895 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-176999 Malicious code in nuuur-zidan-tea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05673a8df673bb19d5454826b918db1b16efc542fa2caaf8a45162219406c63d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kapvino-soni-favavraia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e61ad79fbc01e8c3f050333f4c498becf893502ce8bb75eeb6f7de8d9511192c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-173973 Malicious code in diva-tugafai-imagga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56546bcf43f53d499079f74ffc8162ceec654285e129fa93e28630f43efb1904 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in polymeria-nuyiagtso (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d709c4d157bb883e2349a64e5be6b5c93de8bd2dcfa85c83c2f2c5ab08cc889 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in suharta-poke7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ff36973e96994c12268e015cd78fb2f36a2178254afb34d6318384914167817 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nokiragne-afgagafis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 328faab1c0ad4cb9a54fff3e6a6097fda51015df96105f93578c167516044a70 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rino-poke8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfe19b42dee89c876b8d299f6694aafda05151f80e1f085389221e508f1aadfa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in avminah-fagis-figa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90cc9c731ede30beb59dc483904da696a9674e1ced0435e89f1622d0a2eeb2b9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-153133 Malicious code in avminah-fagimas-ofisugooagafag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb81634debd98ee5ccb53dd1c8dc99f43a93e4dc3744255f5631b0e355bc8d02 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-168449 Malicious code in tealove-nanami20 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee19211fce23f4c8f2479ee02e030bb0a0c15595a5af3e8f1a0c42b6ea2d168c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...