Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

MAL-2025-176768 Malicious code in nuilva-daerde-oagfafalif (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16473925091256af5c05ec9e2288cb0f885b49a61edce54016972efa0929a678 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-153025 Malicious code in aviah-afiaga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9011ec86967ec7365a38995cbcc18feed364f0cb7720ab937e3904bf84d1cac7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-124508 Malicious code in yanti-sroto84-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6dae9824f134233ad4a098eb06f75117410d929c0e9e643ad7786af3df49ddaa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-60716 Malicious code in irrelevant_harrier_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c748cb9f22fa33a3217285b2ac6568ca9a0c7f007712ff8785d3735e1b070bb4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in joko-bakso74-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d5dfc5b082b5edcbc23fa10b03f0e49d8168f3114492b80e4ab126cc6a7b215 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...