EUVD-2025-115635

Malicious code in cassini-nebula-sequelize-tool npm...

Malicious code in andromeda-csrf-got-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b156646e5ae6831d28447dfb85a6d23732f46c59aebb936a8622ec2da9d24ea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143219 Malicious code in heka-tool-fornax-schema (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57f8bd622c042375df8054a2714cc5559b394b0284100a27f4096c2744dab285 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141913 Malicious code in electron-eslint-aether-style-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d1f7548f783c12e5c8d0c42b73eac3624796ce6e399f4eba565d01f3f352840 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149776 Malicious code in yakutsk-postgres-tool-node-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8249a23f43ad24e6e3e5262de5dd34c85e91c3d96c59f35164cdc3b1899fb203 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

TOR Virtual Network Tunneling Tool 0.4.8.20

Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features. It provides the foundation for a range of applications that allow...

CVE-2025-49145

Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, a user that has enough rights to create webhooks mostly administrators can drop the database. This is fixed in iTop 2.7.13 and 3.2.2 by verifying callback signature...

Malicious code in wibowo-bakwan40-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39ee19b9ad1e3687a5ca28e380d5b2f1a69698444c934a9ad2e520168fe54e4b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-119913 Malicious code in fadhil-soto8-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 847a75231f1c6c6eaf0a6cb4455436028bd436bb24c997277911676a60370cec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rifqi-empal30-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 569f209dec545b65c6d48af1b4535fbb99a04899ec1c2470f1281d52684b5b25 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-64687

In JetBrains YouTrack before 2025.3.104432 improper access control allowed modify MCP tool logic...

Malicious code in precious_gecko-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc3c7f1d5542f6ad5f19beeabf22343fa0f1eb9feabc70097a159b8be8354d87 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-76155

Malicious code in obedientspider-tool npm...

EUVD-2025-75980

Malicious code in pregnantboar-tool npm...

Malicious code in widespread_bobolink-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12676b5ca8f737dff742d5a8a67bd6679d4d38f7fbc1b8e69e7fa3267c225d95 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in garduup-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8584f5c4ea73be1cb26aecedf5ee168a7dda217898e98c7d69d155385fe98db This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-75501

Malicious code in superiorvulture-tool npm...

EUVD-2025-75235

Malicious code in weakswordfish-tool npm...

EUVD-2025-76751

Malicious code in gloriousdragonfly-tool npm...

Malicious code in bored_bird-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad6545fe9ba2a5e4fe4b42d1339a3cfb21e748d25d398f8b9aedf57dee3bdc8c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...