Malicious code in commitizen-style-loader-ursa-hugo (npm)

Source: amazon-inspector 55d2ebc38705a078126552608b320280b5a60874c5f00b2dc23be6eef2c6a79e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

EUVD-2025-115908

Malicious code in build-ursa-hugo-pulsar npm...

EUVD-2025-115164

Malicious code in commitizen-style-loader-ursa-hugo npm...