CVE-2026-71866 Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema property name is emitted into the generated zod.object... schema without safe encoding. This permits attacker-controlled JavaScrip...

MAL-2025-189702 Malicious code in stub-emulate-decompress-view-sandbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3014404892613825d603f59e7f5acebc98b397d1e96068233852a6fa05f78311 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aibola-miloipe-apamaumai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f21be9b9a9533d372f0d2727078f7f26ba4224b77de562fe931e7d73a51a81f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lookingan-nanakila67 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0344b67cd5e13ef350edf34867e8e12064c55790d237d0cddc802749d33438f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-175349 Malicious code in kapvino-sogdani-gagu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eccb647e3fc7a8535fda6a22d59d73d4f6aa6a5ac4d4e0754524d938625e9576 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-177098 Malicious code in nuyar-adudar-badya (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3c9245ee249f2c882e929118252ab415f43d94793d5cc0fbf0153bf159776e8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in augis-pod9r-munafpipoa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 709615b810990a5d5ac1299d8358c9c4ccec0a283cccaeea5246b25968bfd37b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in avminah-agfifagaga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54d0c921de549bb95c3914920378ada8c9e0c5e8ee89902327142fc6868ac398 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aiboa-molipie-aramisimia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c4e524d7d421ba1bc43e4074567a6d15a8eae59cb1fe791c27cb146fae6e7ad This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in shilang-poke43 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 028d2d4e8d17499c177ea37e854fa981f336bd4e4b9150244fde30a2acc42ff2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-158536 Malicious code in lookingan-namakiki27 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f0a7902465cb6437ae617356095fa92e701e7c0e4a4d7d727ffb567409b30d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sqlite-gemini-procyon-cressida (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33266839bd8ec4b49bd7e073f4cb98f476214e8f83e7217a1b25ce0b091c8219 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nana-peyek91-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5b53eb29f1dc2bf70d6faeec96e6dc47eff3954bdf391ec6be660ed7e88f2e7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dynamic_heron_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7a6c0db3cbeb5bcef312589e6ebd427aab012c5fd417cfcdeb6c5a0550ff177 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in like_lungfish_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94a00b6adf08c93f1c73e37d7ac432057169ac55be2d5f50e36541c109be88b8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in elegant_lemur_replicate_automation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 528f123248394de8e5e491166360ac945879b59f8221cef38e32012fc59c38d5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-110156 Malicious code in unknown_snipe_dumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20ee37dfa4bcf2737652ef6b1b21c5b87276951824c8bcf4127f24dd9fc869c0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eka-lapis87-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d67e8d9f62d7c4ded6b5b5e8e25279dd0466670545bd562244435f5afb374b3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-83322 Malicious code in arif-sate78-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce11777606cab8851490579e38d02ff70f7633a01ecfbf7532b0a5d8d6281b66 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-89604 Malicious code in putra-semur44-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 319739daa1fc166e8134d5b6043f6634c82b455526dd2bb01477169f28899f85 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...