Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

Malicious code in fermion-thermosphere-hawkingradiation-astrophysics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab3f94d8bd92593a24f0fd0e58ac635815bd45cc2fe9e1bc8f8966b92314a08e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hermes-version-mdx-yaml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5006ef0eabe6994dd52d5fe0f9aabf541ce2dfe591b583436dca8eeb42495bf7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185787 Malicious code in betelgeuse-backend-primatology-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c5995d6d5645041f7e7ee5a9952e52c2b3df30f72996e6c50b6cc3211a8f910 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189515 Malicious code in sirius-darkmatter-lint-staged-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac68762e33089807478b221c74a906d070cef10fe0699ea1243ff9090ef6d249 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188518 Malicious code in paleoecology-backend-hydrogeology-postcss-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20ac770bddada6d8683dab27aa4b1ff2328daf6bf4f00fd6061392212b35abb0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185573 Malicious code in ashjustmeteai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09849e4d7bb47b00bc95d21ce1d37e4b0161620bb656822277846a8d2d761245 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187666 Malicious code in karma-cross-env-mocha-grus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc707037d54ddbddf16b2cf0245a7546cb636b2bd26cc4ef826e23f5433923df This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in quito-config-lightyear-quito (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2774879e2c0a7ce0d979c45203cd24a0201a338f4a913577244ee6c095d46e02 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in markdown-dotenv-whitedwarf-decoherence (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5aaa9a0b578f1e3065838d076e1317f2e55e73fa4a622e040910b8fa3e0bf73 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in string-index-dog-abstract-simple (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0af2d6d92154eb01c8b45b503a35405d1411364034f103800c56b39d2cb0a2d2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187305 Malicious code in heka-markdownlint-rollup-node-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3918091bf1dccaa7a82585cf98bba21f487de7dad3e092c4d5f4c7b1b3c7e9ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in geckodriver-singularity-radiometric-xo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8764fe88705c289fdea526ae1614d7e7398106a4765eabec6e4e9800401611d3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in playwright-dotenv-parse-variables-parcel-less (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26879ce998b4d9b600336074c9192fff930a75ab32ce0d905c45dc8f8edc2942 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fast-java-stub-void-bash (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbf6d41c7ef745a2b7ef1562477f9a960072b1225abf823fd2d741c10222a6ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ethology-iota-neuromorphic-neptune (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c349c02c37272bcb7f70315c8030c7ef1d1cde0ccdde448c9bd2ba509fdf605 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187181 Malicious code in global-gridsome-oauth-supervisor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4e9e7cc1e7c42481f808804394b0a8b7ae377b94f9d631eda6a135a33dbc5c6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-190014 Malicious code in typeorm-csv-troposphere-socketio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e73547aa88679589280af7f97832cc643441c415a7b0c69aa00448db76023b7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188334 Malicious code in nodemon-kinetic-native-cassini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db0a0e399774059c86b18263f553a0c4e86eb2e437c88f3ce39f78d204bfe905 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...