EUVD-2026-87938

onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences in project manifest version and name fields to manipulate terminal output, rewrite...

MAL-2025-176587 Malicious code in nuilva-avm-rucasiva (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bb806950b93c7f942d8cf226ea765feddcd582eb86f50200234aa33042f46f4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nokire-nana54 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7daf2a15481f17906fb33594f60fa8749bd60b99cb9047fd16f08a0bc514135b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-162872 Malicious code in nokire-loklok20 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89b0af9676c19ced3467255a64d0b8ca21b77ab2e0e930c3983d5e0611ad8693 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tasty_cardinal_dumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d6d7042482402b3b24a95fa30e0e936a25a249643bd8b0f5a375a43939480e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tiara-rawon42-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76d64a23df2002f08d9bf2ec529c54c5d09246a5a579cd4e9dc921624cf04637 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-108033 Malicious code in riana-nasi62-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05b50574c09d0f768908483af0506862c7ee39b902fc270dba6bfd0e03a8733d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-107703 Malicious code in rainy_tortoise_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be04aaa391c12bd6d586f92ad274b8260a23aafd81624ec66c3ae715bc2cd041 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-83113 Malicious code in agus-ubi33-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac7b81a7496fef0c12f7d192dd8ccc6655376a12ae2cfe7b360b1371182cc5c8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in agreeable_boar_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4053b8b4e6df0324ac428627540038bcffe278fd267f26c5eebe36476a91488 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-85696 Malicious code in free_moth_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e87ab434b021c3e11c8134ede79284764139c2ee79d73628c91a55121ec70513 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wibowo-menjes85-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98ad4e6a93fb5695e059d975f20eaf6eb23857177e2474b7cc278c76d35f70e3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...