MAL-2025-184023 Malicious code in mitoko-on-lakoikaunoaak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acf133996059df362a09e94d06cced079080fc9aff62f8f0b422e8a6389d4dd7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-183606 Malicious code in lomi-ifush-ugikobi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acd8b103aeac76898bda653f5d22e72ba5f8ba198c0b365b78126b9b1613830b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in manu-oib-givakisauois (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9dfdbb04ce41b00043ea3927c420c3aa46bc7ea22a3ed15f5e70974c5f01e3dd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PYSEC-2025-112

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator pcg32 to generate cryptographic keys or...

Malicious code in @akunsansan0/biru57 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50d3a6ca4a868b02dd93fc667dfdf29195356ff861cdd7370b7a4a2dfd4a103d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in @oppo25/depentehtea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 209c89b2d6e7653b79cef266c433ea07b9ef949901816d639ec9eaf4f3bb245a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in baso100 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34304c8686d8af42177beae58bbba859163889c7c94d57fe722bbc9ce2be52d4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cewe25 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d2629b933c76aef884e1a71e636e6e7e7a2037a0f8683cafaba6a987583b8bc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-181515 Malicious code in roti1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdac28f756529053f34e862909f4264f1add4ac188d7c3c7fe6e3bcad43a6331 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in @akunsansan0/kopi6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84676474d07000c89959bb5e3f38f9e05ed85e8f43fc8cdf165f03f2d2d3ebe2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in @akunsansan0/karedok33 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30432758b1d484b88d8d61f8109e9450f98d8755a6bbaff4b3d4ddafa9bc52ff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in baso72 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d23435a924ee123fedd1be4d59bdc45109013146d7d63a16d9fb0e69e978ca5b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in baso8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0e10175d639562bb303a4b140cfcf11dd6657ee0442c1665bc728c1a57a03e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in @akunsansan0/susu3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2a264ee9b1d2e14f156e15f51cb63b5c64be9f585a8676184698794f7c8a281 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in baso25 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fd5f2b5f0ed84ce72e37c976c0d9b0dfbedc5f64ed6890b498e203fd75474e2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in @akunsansan0/biru29 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43fdeacca2af93853b7f809684a7a8c8d00f9d05a035a3fd3e00094fe949c4cc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in @akunsansan0/biru34 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c14b5b4750346c6b92c23ddc598efe28ed96e8f93c46754b8fc4f07c62435c3b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cewe2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b61da6f7ac2cc31c818c1789be09f08acda2f315a0bd2d0679302512c22f61d3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in baso85 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8340c7c563d498e3f293603ba793c3250f073cdb7515cf33efbed163fdb1eef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in @akunsansan0/karedok2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b24d9c1fb43b93059d24ad0598bc636e7b55ca4614303cd93a78edb37f0da9c6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...