MAL-2025-69101 Malicious code in legislative-indigo-aphid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8965b582771cff5098b8c1d405b346a4175b70278bbed8297ccc796d310bb3e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in divine-turquoise-ptarmigan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fd5fe7a0b3b08c5da63f48da32ac67afa7695ba0b7ccc7f0c12d8012bbd138c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in useful-amethyst-peafowl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa8ece93c27c63e0f76bf8e703416ab0507ffbfae846fe6e67f2f4b9d189f6d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mere-apricot-ermine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cf02c29eaad01cd6dd4b664c09c97023caa50715b2a8543fb18f97a8b018c8d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-67527 Malicious code in crazy-beige-goldfish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6f648c4bb6b80db0adeeed0961f2150d876ec3b3ff39e7f0858912de99284e4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-62746 Malicious code in enormous_wombat_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea338711b11e4543a276144cb983538c0a123d8f4c43bfa2c6abb5ff07489931 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in udin-mieayam31-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8ce9f3115705ec5859db5984d08b21ded8c16243821f91731917a15b05d80ad This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in socialist_newt_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eba9d47ff363d5773bfc6a440424d3394e6c3d188f86a9c16ef197ac5e753f6b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-60988 Malicious code in organisational_gamefowl_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcf255ced1c3f37c58b15e2ea3fe88194c6066f86380053923c1c68ccb384fcd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nadia-mieayam48-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec7cc63a40d92825c60d734f056c78d6508241df493c2f44b11a7aabe95f9175 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rina-klanting2-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e03beec5ded505308547bfc350f215abd04988338967c68f8c8d2ebf08556e30 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-41819 Malicious code in @hpx-core-experiences/react-my-account-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 07356e94cbef647858d04baaf3188c3c72ea8ba194c69b6000d0674ccaa1ac71 The OpenSSF Package Analysis project identified '@hpx-core-experiences/react-my-account-commons' @ 11.0.1 npm as malicious. It is considered...

MAL-2024-10899 Malicious code in cloud-functions-schedule-instance (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d10678b76e1cf601f3ff31de7642b60bd56df7c7899eb2c23808c2ef0ebf778 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in stripe-deep-dup-tree (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 29790a4dda8ea513434302f82a02b4ef9cb90fa0b9e63de804082d284c8cb989 The OpenSSF Package Analysis project identified 'stripe-deep-dup-tree' @ 1.0.0 npm as malicious. It is considered malicious because: - The packa...

A scanning tool for open-sourced software packages? Yes, please!

The Open Source Security Foundation OpenSSF, a collective of industry leaders aimed at improving the security of open-source software OSS, recently announced the release of a prototype tool that scans for malicious packages in open source repositories. This tool, conveniently called Package...