nakaki1 (=1.0.0), nakali1 (=1.0.0) +1 more potentially affected by unknown CVE via tea-vibas (=1.1.4)

tea-vibas NPM version =1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on tea-vibas and may be impacted: - nakaki1 =1.0.0 - nakali1 =1.0.0 - nakami1 =1.0.0 Source cves: unknown CVE Source advisory: OSV:MAL-2025-180035...

EUVD-2025-133802

Malicious code in tea-vibas npm...

Malicious code in tea-vibas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7614fe458da444655a42be02af315bdbd8792cf90e027d126da0e330e4d80fd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...