MAL-2025-184644 Malicious code in odasv-knu-boniju (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3eaa86eba0741be553b57b39aaf4d3ed186abb4275b4aa8fb8c29f06bf4216f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-181947 Malicious code in flights-ilutg-zilsdgauma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 407a37cc1e27c1d29e28f9bbd26f4fad737a9760d4b79dd4bd92ca68e2020b94 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185339 Malicious code in unise-kit-bogavotaawfi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3410b120e2ae4965125c564ee09b3d36062988c478d1de2bdffc4d4b7d4d1722 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-183316 Malicious code in libc-ubg-atafuificafaffaig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0dd7042f6b796668e1cc2b89be8a4dcf2866e6bca5f820f339095e9928c8936 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-183690 Malicious code in manu-oi-gisoaug1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0210cb5e014b0eaac4ba2e250ac799fee8a15265ed98068f70bf86b5db9d562 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-183703 Malicious code in manu-oib-giso (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd9b2f4e74c5236a314eef0d170151546a9601a797d8ad6a82493575961334fe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-181987 Malicious code in flights-lutg-oid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea48fbcef2b35d9aaefde8490a7665e0923edd5ca9ff482f47681f1e9d200530 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-184140 Malicious code in mlokok-lofki-afugi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11e05b5c85ea05bb9a1810984da2117b3c966f311048adfd80e18ac11a32b04c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-183359 Malicious code in liobc-uyg-afayafuyacauicig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8569059c36ee09f7fe2c1db553a6353608579574a6faaad763e58064ca45ad0a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-183492 Malicious code in lobac-ubib-gafunb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ed1aad346e15fe331b7fb58d6ecbf0f7470089a66e1d65e91c08f7ecfc2ed8a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-184307 Malicious code in modiov-kifni-ufavcseqinsdxaoycurptvuban (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bd28b3c45a2dec16188613ba78931b53abdb4e5fd73bf9f0b517f3d0f2880db This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-183415 Malicious code in lobac-ubb-avigagu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c75959934e91d7ff529133cf25bd415857d7933f1e345284f61fda80abc75d31 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-182969 Malicious code in itale-dci-fngduye (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc97ecd09b50afa9247ad65fa05f3b44dd3b38ee941ea4f7d5b24fad3cc18a16 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-183762 Malicious code in manu-oyi-giuosgimsof (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 258a73a1755c4c017c6c8511de5b348481cce041293d6f45e6298dd68ad21113 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PYSEC-2025-112

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator pcg32 to generate cryptographic keys or...

Malicious code in @akunsansan0/biru14 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ece4cfb5b7f019f9ff65727dfe20df929ae4ec04fb8703a1c9c26decd143a579 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in baso75 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a46d594f19f1f15acbaf19198e316745ddb1a0f18b65ca0dd920c8b7537a1def This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in @akunsansan0/biru10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e511648cecfaa67f113fbdbc834928ec9009e87dc58ef1d23a4cd0cd1b6a4087 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in @oppo25/depentehtea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 209c89b2d6e7653b79cef266c433ea07b9ef949901816d639ec9eaf4f3bb245a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in baso72 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d23435a924ee123fedd1be4d59bdc45109013146d7d63a16d9fb0e69e978ca5b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...