323 matches found
graphmb (>=0.2.0rc0, <=0.2.3), openstef (>=3.2.43, <=3.2.60) +1 more potentially affected by CVE-2026-53995 via mlflow (2.1.1)
mlflow PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - graphmb =0.2.0rc0, =3.2.43, =0.0.1, =0.2.9 Source cves: CVE-2026-53995 Source advisory: OSV:GHSA-WQMH-QCCW-PQWF...
Malicious code in lint-staged-virgo-hyperion-tool (npm)
Source: amazon-inspector e924afb6228655e2fd4c9b610dfd48fca3da2e3f941eeb8bbb722a38e1547bc0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in lint-less-loader-jekyll-virgo (npm)
Source: amazon-inspector 94f459bf148cb91c899d7aac0403072e50f2ba7547640fe1ac3cebbc1d9607e8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in less-loader-virgo-phenomic-typeorm (npm)
Source: amazon-inspector 52d8ead56d5d6ecc6040860414893d3628f57a62269212a768df83deba87f671 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in kinetic-antares-weywot-virgo (npm)
Source: amazon-inspector 5bff93183c6f42f2fb75cd6083a89b6b5d26427d278de47384359f61e64082ee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in jest-xenon-virgo-jest (npm)
Source: amazon-inspector 41052832b11c01621451b9c793d8ca4bafa5721676a30c232182ae3cf32657b3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in janus-capella-chakra-ui-virgo (npm)
Source: amazon-inspector 8fc3985c314ded858cdb376cd4016649b8cf4e1fefb2e0297becb00e111d813b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in izar-virgo-library-dotenv-parse-variables (npm)
Source: amazon-inspector 6a584237b56eb540fa7a336cb2e55a1a35745b2e69f5dbaf4ea5b1ee12221ce9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in inquirer-virgo-global-regulus (npm)
Source: amazon-inspector 026e5004027c23baf1096ee291d7d46f58a34bf01ab59e3bb83f497be54a0955 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in indus-virgo-publish-taurus (npm)
Source: amazon-inspector ee5e343e832dcd592b7407aaea23128dadf679e0c78cc297bbd29ff497ab04dc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in indus-coronalmassejection-sass-loader-virgo (npm)
Source: amazon-inspector d0136da2a3eab2db131d20c5f0b95415457e01a996714a3b8ed1f5c147cd38b2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in hermes-development-virgo-promise (npm)
Source: amazon-inspector 5b9ebfa206b435c81a56d67d919dc4e28ddfda901b05abe2419b067e8de16f38 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in graphql-virgo-prettier-ursa (npm)
Source: amazon-inspector aaf0c2ff36e58cc35243ac8e68be82032aa3e1c00c0ac502474a893c01758736 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in global-draco-virgo-bellatrix (npm)
Source: amazon-inspector ac8da2ab4b62c8dd339ff475a68b7c495dc169c8043db895cf6966aa61fdbd81 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in event-virgo-electron-blaze (npm)
Source: amazon-inspector e004185e6eb62e9c0a652221cda1897c258c819d0e8dc5ba761875333b52b61a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in event-mutation-commitizen-virgo (npm)
Source: amazon-inspector 71b32949794d833bd6fd57a5723e080406ca3e2764c0bd31238063217658db91 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in eslint-plugin-husky-pavo-virgo (npm)
Source: amazon-inspector 1e746ee6f0fa370fc7f0fb5e7e4e47d2df2a52bc77ffee749e24d95a1f10b426 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in eridanus-virgo-quark-vuepress (npm)
Source: amazon-inspector 5d5b5961c285e24c52d9a27105f2da7bf76ecc51cc9f7ed0f30b880d604b3077 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in electron-virgo-izar-commitlint-config-angular (npm)
Source: amazon-inspector fb4cf8e13bc345ccf34f66d35bc121a7daffb3dbb0cd0836fb77d60461836eae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...