MAL-2025-191442 Malicious code in uniswap-smart-order-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dbda3147fde915a97ddd97f51f5ebc1757fa14bca7cad95f333862ad125c3c1 The package uniswap-smart-order-router was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191020 Malicious code in tcsp-test-vd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9f8fd99690655a6e155948c83b8baf3c7d03d10aa4adec3a8e87ed21a96921e The package tcsp-test-vd was found to contain malicious code. Source: ghsa-malware bbc33c9b0da4ee5d72787025ea4a8ca6f7c7b140ba2cb7fa40a3cf6703cb61c8 A...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

MAL-2025-190675 Malicious code in @posthog/rrweb-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de65400909e7dab680997106feffcc22e5a954f60fe775e82db28e5529bacb0c The package @posthog/rrweb-utils was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190579 Malicious code in hellospa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0582933888e4badd81ead15c78b68f8de23a0c728b5a1584f737bedcfd569184 The package hellospa was found to contain malicious code. Source: ghsa-malware f4e9282a1da51cf6409a4e5196d718d73e8f6f8dbddd339cbdd0535658517576 Any...

Malicious code in markdown-electron-europa-markdownlint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da241035c8c6043578692ac4ee05dd47f6b4d6d0a9301ddc80f8497055acb487 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bunyan-spectron-webdriver-less-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea996c13b6b5a184710be958777615f73170e5e8f3a5e8fb00260064a7d769c0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sirius-lynx-antares-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe1b1189742e5aae02454df7ad46c469deecbe1d18ea01b1feb3d6b00b7c548d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187537 Malicious code in iota-geomorphology-rate-limiter-jasmine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 346e3847a3afae7b06fc9b4ad231de81c16e9d099a34651a5080fcd332454451 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-184378 Malicious code in modiov-kihan-avcafivaviagfavacd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c650f0e8c53b9b025821490b969d1c64c2e2676c78c2cead71990c773ed7285 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in avangi-olia-iaiai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47093a7d8448c760ea60c35f842c7e45f15ea4b3b9d0f0e4292175c4c700ea29 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in avangs-olium-nt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9cb983febd18968a8597732bf01c611ca293ca69c6a38ec0b596c88fa6ef2550 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-182879 Malicious code in itale-adci-ggryuyegfjbsgbebu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f48865573f9e64826fa7e55a1c09465cc8880f2886200d6fa7a69245fd171afa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-184805 Malicious code in poliaoz-aiksdfo-alfdaad (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e0dbb80930a33d34b79f8865f21ee5d22302a9dfc9a9a8d429d543f856a43c3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-180639 Malicious code in teate-thy-sonic-lepeb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20082f10f6c35c2708b3f4a5a17777da0ab038431132dd434caa633b6c9beda7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-176689 Malicious code in nuilva-bavam-madianv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e354d7a00f9a1a20b781a9789554aeb316a9d87a72d2baba03a39a77a6375703 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sahu-satg-iufaaugai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ece8372b0381b6bd7fef0f9ef492e97641056884ad92639a12b74933a6837a5f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nuilva-bavia-mund (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e59f0cda2e163ffdf400e42103cb3c9cc5ea5340377e593c8f7e45e514c6e2a7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hunimana-satiub-naiboib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ed914dd74ae15e0abdead71a81a5b85b987875a307900621501dea8bade077e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hitachi-poke88 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57a45b58d3a5594cb743ec070e9eabfa950860e930c6f1cca3b54b59e3c9ceab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...