Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

Malicious code in pino-pretty-exosphere-cosmology-rate-limiter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08a544fa29680af5c54610adfa452377cfc65b7da7688a42a38a60bedad4bd30 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in anidata-houd-mavida (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 578a132a4ed0c0322b7c23a965b77d8e259f4aeaf0d6f85a64602cb2371585fd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tania-ikan9-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95d1b4728700ea46f4010e012f2561fc51d26dea2c7de6570a11b12b33eef94e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-90358 Malicious code in sari-klanting16-crottsekebon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 362a7703f49532e563307f4673e624d3d037979d6878699f421a389bca8f9c54 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-68623 Malicious code in guilty-scarlet-marsupial (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3df2487f398a89ad3fbb1916852ee40829597b96a89a2613daab3d90d877f12b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in multiple_spider_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1331290d789f3118f3dcfb02fc0d65ea32834daaa0ff50e315240ec00d4d4f84 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...