Malicious code in pavo-mongoose-yaml-development (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f526fd620049d5e20d88f616600242a7854959f96259dc05de485d4b6b9aa1d8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mild_pike_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69aad0fa8b547620c49bf140848c467c4397411daae3bf3d5055bff4ffe49d16 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-75872 Malicious code in umi-oncom29-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f41caed951e06180ec79d0242b051ed0db876752dac9635f64c886a00b8d97ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in shared-chocolate-constrictor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50f63ec33e4ff5bb8c1808b2e220c91a5d78c70ed8de16834cf769bb3ca2ba4a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-59334

Linkr is a lightweight file delivery system that downloads files from a webserver. Linkr versions through 2.0.0 do not verify the integrity or authenticity of .linkr manifest files before using their contents, allowing a tampered manifest to inject arbitrary file entries into a package...