MSC-2026-12985

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Code injection testing – an attacker checks if...

MSC-2026-12497

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Code injection testing – an attacker checks if...

MSC-2026-12606

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Code injection testing – an attacker checks if...

MSC-2026-11699

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Code injection testing – an attacker checks if...

Malicious code in fajar-keraktelor49-miaww (npm)

Source: amazon-inspector 3159c4b792dd489f552ce3aef9c9934a32c2d80a024a7cba2b97436b863cf249 The package fajar-keraktelor49-miaww was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded npm with over 15,000 spam packages in 2024. These...

Malicious code in erick-botok99-ruro (npm)

Source: amazon-inspector 8359485a95e22abff88f626e52141f9aa015bee6c9a7f494972b09a50cf533d2 The package erick-botok99-ruro was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded npm with over 15,000 spam packages in 2024. These package...

Malicious code in eka-ubi70-riris (npm)

Source: amazon-inspector 908ad9a3a240b6953a37b99ba0d950f36e93028e4d4dc691867b8fe326035325 The package eka-ubi70-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded npm with over 15,000 spam packages in 2024. These packages...

Malicious code in dewi-gembus95-apidev (npm)

Source: amazon-inspector eae78e49c4dbfb4ac9400cb60d5425943e91c6651f96deedddc0d19d9a54aa9b The package dewi-gembus95-apidev was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded npm with over 15,000 spam packages in 2024. These...

Malicious code in citra-kupang96-tititugel (npm)

Source: amazon-inspector 57c0e9b753c4f587d69ec03765e3780afe3dee3929fa75bae76cde3894c649f0 The package citra-kupang96-tititugel was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded npm with over 15,000 spam packages in 2024. These...

Malicious code in andi-rujaksoto45-sluey (npm)

Source: amazon-inspector 851be5f0bf03844e61871509830e9ccfbc9835c14e5e86955a384b09be4d4a63 The package andi-rujaksoto45-sluey was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded npm with over 15,000 spam packages in 2024. These...

MSC-2026-11565

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-11550

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Code injection testing – an attacker checks if...

MSC-2026-11543

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Code injection testing – an attacker checks if...

MSC-2026-11534

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Code injection testing – an attacker checks if...

MSC-2026-11395

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-11396

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Code injection testing – an attacker checks if...

Malicious code in erick-saguer36-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f5b26905752cc2966be32b50544deaa36a3f92125578562f9bf1d51dc4a65ee The package erick-saguer36-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flood...

Malicious code in gilang-kembang11-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 121f6337e969b21e5299de5acc69c7fc0b9817accb326fad07118600df210554 The package gilang-kembang11-ruro was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

Malicious code in tiara-naget54-kyuki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fdaa5413a8800d3e010af7192aade6f9ceb75d947f00457761670c99b913b5e The package tiara-naget54-kyuki was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that floode...

MAL-2025-51343 Malicious code in cindy-kemplang16-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a122c39923de2194ab0317c393f5a9771dfecc2b8f24fca552e0059af9ee94a The package cindy-kemplang16-sluey was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...