MAL-2025-181587 Malicious code in astam-akif-dak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4857c32a5bd3b949470c99c3240ae9fa3d15dbe26b49470766177863321120dd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-183856 Malicious code in masv-ilimo-civuffana (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5de38566b2dec2293fd9851d7ca7dace9250035144b7d33ccca51cd648a14f11 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in item-atim-kubuka (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5625c68e9ddc9d41b03aab3da773f2b02aaf797a3fbd402614368bbfcf5b4ac9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-182380 Malicious code in imodiov-kufi-cocakmi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57038eb96fb5a78c6c5d9e7a282072fc49b1e501b11176e136646f90f5e498c1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-184030 Malicious code in mitoko-ontcami-lai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82576c1427c98cef2ce838aa805389779b5ca02d093722535d4134a6f54f5e6b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-183121 Malicious code in item-atim-kubu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 037fe299eddac5e596eb43434e60ab3e6d0f2945568b168031ce7875fb033ff6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-182504 Malicious code in imodiov-omfi-cafacevavisvoetfaa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcdcdc5e94b455ca0c3a1f56aef24e0d1bc1137b29712f26e5e0eacc2687bc92 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PYSEC-2025-112

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator pcg32 to generate cryptographic keys or...

Malicious code in baso85 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8340c7c563d498e3f293603ba793c3250f073cdb7515cf33efbed163fdb1eef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in @akunsansan0/karedok33 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30432758b1d484b88d8d61f8109e9450f98d8755a6bbaff4b3d4ddafa9bc52ff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cewe25 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d2629b933c76aef884e1a71e636e6e7e7a2037a0f8683cafaba6a987583b8bc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in baso100 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34304c8686d8af42177beae58bbba859163889c7c94d57fe722bbc9ce2be52d4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in @akunsansan0/karedok2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b24d9c1fb43b93059d24ad0598bc636e7b55ca4614303cd93a78edb37f0da9c6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gun1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e39996ab245b744a18cc86ef786e37d389e5830144e272e9af07c90f6871a0ce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in baso72 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d23435a924ee123fedd1be4d59bdc45109013146d7d63a16d9fb0e69e978ca5b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cewe6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e925b928e8cc2ebabbc5316670e9ee5efaf8b82a10e719b6ef8c7f389ef7791 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in @akunsansan0/biru34 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c14b5b4750346c6b92c23ddc598efe28ed96e8f93c46754b8fc4f07c62435c3b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in guntur6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8b6c63eaabafd4d1696e5b9f6cf2523596548a56fbf46d0561730ebf6017cb9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in baso8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0e10175d639562bb303a4b140cfcf11dd6657ee0442c1665bc728c1a57a03e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in @akunsansan0/kopi6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84676474d07000c89959bb5e3f38f9e05ed85e8f43fc8cdf165f03f2d2d3ebe2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...