MSC-2026-12355

rimraf-utils 1.0.1 is a malicious npm package published by owner in.t.re.p.i.d.n.m.w. Its postinstall script node postinstall.js harvests npm auth tokens from /.npmrc, /.git-credentials, .env files NPMTOKEN, AWS keys and npm lines from /.bashhistory, plus hostname and username, and sends them by...

Malicious Package

Overview link-ursa-nova-rimraf is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in link-ursa-nova-rimraf (npm)

Source: amazon-inspector d44d6e84b842283cf109ff27c3aac47525e74f91b0b9e53ef219fb4ccfa1c59e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in karma-rimraf-start-hercules (npm)

Source: amazon-inspector c0eb4590aeef4e7b120c29ecc32f1bdc8b21fb1334cd127cfbdd283acfc43a49 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in juno-eleventy-prettier-stylelint-rimraf (npm)

Source: amazon-inspector b6a310c6f44311b90b0c366863dc1251a35c2ec6b74bb4561c289bc7facabed6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in jovian-hydra-chakra-ui-rimraf (npm)

Source: amazon-inspector e11890f1057cd031f348255b194e3c7423681fc7aa622fb91bcc95d904fda02d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in jest-cygnus-chariklo-rimraf (npm)

Source: amazon-inspector 896f80547b404fb50cbadc8829b66a71a8905c7345dbd84caa6331254ca7f91a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in jest-heka-wasat-rimraf (npm)

Source: amazon-inspector 04249879ac576d79fc9e7765efb7d944f2ea8639c65cc9aad3dba332dcfc98a6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in jasmine-typeorm-rimraf-superagent (npm)

Source: amazon-inspector 8e8a392fb62946ebfa7bf33c9cdc619ac1d918dd0e4e847bcf89234e2b4acbb2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in janus-ursa-rimraf-telesto (npm)

Source: amazon-inspector 13fa8467d781bb8828c170ff1d24643e2fc2541535f36c7baf5fb0ec62b92371 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in interstellarmedium-biomimicry-sirius-rimraf (npm)

The package interstellarmedium-biomimicry-sirius-rimraf was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in install-rimraf-nova-antares (npm)

Source: amazon-inspector 27a6bb9d55fc9bbf225f87ea52b6f59a890034af0ab668485ba8c1b7b3b42f6b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in indus-fork-rimraf-forever (npm)

Source: amazon-inspector fa831a89833772caceac7a6c6708f1dc1efc4af5b76d2e7f5c29c49b52d87fbb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in impulse-rimraf-schema-webdriver-manager (npm)

Source: amazon-inspector 3f086d7a0bdd974da91e3776911c36ba418c661bbf2f3d9fb1a50f0ca0daa4c3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ignite-paleoceanography-lightyear-rimraf (npm)

The package ignite-paleoceanography-lightyear-rimraf was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in ignite-puppeteer-sedna-rimraf (npm)

Source: amazon-inspector 35174f4fc9f936f9c62e71fd6996be4ca74295263e938ba94323a36ce579ee12 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hyperion-jsonp-rimraf-hapi (npm)

Source: amazon-inspector 8f43282474b34da1bf6211270b82aabb48e6a51ed00ecef30170b32a906b9ac6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hydra-rimraf-apollo-gacrux (npm)

Source: amazon-inspector 5862ee4d81cec6ce838fc6610ce9041b85853f5d7b913a818c76b52999ae9d4a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hugo-rimraf-eslint-nightwatch (npm)

Source: amazon-inspector 074c78f0a4fae1045293325cfb302d1b4d38bfcac2d5281d407656997d74453d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hugo-eslint-config-rimraf-nodejs (npm)

Source: amazon-inspector 8bfccf30b1a5f7c4f96740bbe3fbcbab70e17acf331b86b4d3d94a861e7f4d3f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...