38993 matches found
Malicious code in cooing_aphid_z3n (npm)
Source: amazon-inspector a494f2b273f815303e0ef10f8a463fb88d23f9d5b158d75233d997aebf5f43f6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in convinced-brown-eel (npm)
Source: amazon-inspector b9dc8073f407249feba8c4698b159331b839e5e1b7d5782cb802eccd0892a134 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in convinced-orange-fish (npm)
Source: amazon-inspector 3a9808f8d01459e0bf956593c0ab418bb7b7bf70a5b5f2b14a959c7ad01be0f9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in convict-indus-loopback-ariel (npm)
The package convict-indus-loopback-ariel was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in controversial_swan_z3n (npm)
Source: amazon-inspector 8d79e570ca284665fbf3a6b272ac98fb02c1248fc4b1a4fda79938d0339b328e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in controlplane (npm)
The package communicates with a domain associated with malicious activity. --- Credit: OpenSSF source...
Malicious code in controlled_goldfish_z3n (npm)
Source: amazon-inspector 0978b2057f340785dfda7fe607d0804db821d3ba71f1d484435a1232837a9228 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in continuing-indigo-coral (npm)
Source: amazon-inspector 7ea3439682e0e132103b64886a2e03a67d03fa0047485ab1d2a2d784ce5ccea8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in continuing-turquoise-anglerfish (npm)
Source: amazon-inspector 0ee0b31974c0322046b7f7390a9773d3a5e878827481764aad034536d579ddfc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in continued_flea_z3n (npm)
Source: amazon-inspector 0712a942fd3b01f2a77d11809eb2d3bad653b4ca00710ec9ae2bb4487cee4fa9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in continued_lemur-silentdev (npm)
Source: amazon-inspector 32c36ac2fd9ba2e0d6ac9057f6198334a07727b45c5a67785cd9a2e016c14dee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in contemporary_lemur_z3n (npm)
Source: amazon-inspector abb6ca7a5f7c80e1311d5c1a8d0cd4d77145096754b6621a06c4b9783326fd38 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in container-tree-signal-notify-permission (npm)
Source: amazon-inspector b71d5038f64d6e372dc504ee04667b316a274a372b8dddb45c2cd8c93fd779d8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in constant-values (npm)
Source: amazon-inspector 3eef7c3f6399148abe5dab50aeb81b1f42322e6ab93c0a116e7426486bb8ef0a The package constant-values was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in considerable_squirrel_z3n (npm)
Source: amazon-inspector 3c5b92b0d9a4aaf644f145bae9f3bc1bbc8d0ee6a12f256afad9c61fa1df6209 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in considerable_leopon_z3n (npm)
Source: amazon-inspector e3c183f67799cff7d5dc01630eaf1024d4b68955de650aee0a2581d65e5c77db This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in conscious_barracuda_z3n (npm)
Source: amazon-inspector a97a9aa9b97bafbc976a6708091c1fb44bf81adebce84ef3182fa1458b01b6eb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in dolyame-ui-memoizeweak (npm)
Source: amazon-inspector 89cabf491f2003602b491a95e2f258760c5f92aa681b87c239c755aa875b352b On require of the package, index.js loads./helpers.js which downloads a platform-specific executable from one of several hardcoded Cloudflare Workers endpoints oob-worker.cf99-9b3.workers.dev,...
Malicious code in dolyame-boxy-independent-bnpl-separator (npm)
Source: amazon-inspector 273880296b11c362e48b0d7b6d2795c56f8726937482462bee9e615943572d46 On load, index.js unconditionally requires platform.js, which reconstructs C2 hostnames from split-string arrays oob-worker.cf.workers.dev with fallbacks to sdk.dl.wel1.ru, pkg.dl.wel1.ru, ext.dl.wel1.ru,...
Malicious code in elf-stats-storybook-workshop-935 (npm)
--- Credit: OpenSSF source...
Malicious code in date-format-utils-xz (npm)
The npm package date-format-utils-xz masquerades as a date-formatting utility but is malicious. Its own decoy index.js is prefaced with a Chinese comment translating to "disguised as a normal date formatting tool." Every published version 1.0.0-1.0.4 declares a postinstall lifecycle hook...
Malicious code in @biz44/id95-client (npm)
This package is part of a malicious npm campaign published by the biz44 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implemen...
Malicious code in @biz44/process-runtime-utils (npm)
This package is part of a malicious npm campaign published by the biz44 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implemen...
Malicious code in logs_update (crates.io)
logs-update is a malicious crate published to crates.io on 2026-09-10 with zero downloads. It pretends to be a terminal progress-bar library, but renders nothing to a terminal. The whole crate steals files and sets up remote access. The crate has no build script, so it does not run during cargo...
Malicious code in get-power (npm)
Source: amazon-inspector e261e4010770fc43fd02cf8c9add484ea5f8a92a21f60682f2aea73f0ce110f7 get-power impersonates ljharb's get-proto utility package.json declares author 'Jordan Harband ' and homepage github.com/ljharb/get-power while mirroring get-proto's file layout as cover. On require, index.j...
Malicious code in @aiwfm/communitywfm.scripts.api (npm)
Source: amazon-inspector 405cd17e3c682b1341db44361500ea68d80e1758f15387d9971d0af95f0c8a48 The package's preinstall script build.js assembles a remote hostname from split string fragments that resolve to dawn-salad-18c7.mikhail-nab.workers.dev, base64-encodes the full process.env, and POSTs it to...
Malicious code in sql-limit-enforcer (npm)
Source: amazon-inspector 6f8126bab8131e5781af023537f7c5fc2456929c104f71312eeddcea358b5659 Package ships no legitimate functionality: package.json declares main=index.js which is absent from the tarball, and the only shipped source is main.js, which runs from a postinstall hook node main.js during...
Malicious code in noblox-asset.js (npm)
Source: amazon-inspector a9d897fe6a57fc9f74c5dd46a89603da107c43ad60d3854a86987d67f5702973 noblox-asset.js impersonates the noblox.js Roblox API wrapper: package.json copies the legitimate package's description, homepage github.com/noblox/noblox.js, and repository metadata while shipping a heavily...
Malicious code in postgreesqlhelper (npm)
Source: amazon-inspector 8956bc32d5371591e9ad2dd809c55715c24a2b4254a9713e280fb646cd1aea49 On require of postgreesqlhelper, index.js decodes two base64 blobs shipped as parse.ts.map and init.ts.map, writes them to parsetmp.js and config.js, requires parsetmp.js, and then unlinks the staged files...
Malicious code in pino-ulid (npm)
Source: amazon-inspector ade54621ac8726adc77fa29c4176808cdf82d0d1f8e45c2e051a17b1fd515779 pino-ulid impersonates the popular pino and ulid packages homepage points at github.com/ulid/javascript and ships a genuine ULID code path as cover. The package.json postinstall hook runs node...
Malware in expect-dotenv
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malware in @gfe/lx-watcher
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious code in joko-keripik33-riris (npm)
Source: amazon-inspector dcf0bed9514e47614c83a60dbb66024c349218b5d39fa81b290f8b0beaed8285 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in joko-keraktelor36-sukiwir (npm)
Source: amazon-inspector 94d70fd3ea2c72089c6616a749bb5d9ed3644c411d08cc060bb2b23d87a9c034 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in joko-kepok90-riris (npm)
Source: amazon-inspector 0ff1133062662dd8d32dff5bcaf58d18c16cefb45d630e8c3b43b33466d67744 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in joko-ketoprak97-ruro (npm)
Source: amazon-inspector fb5b00d5ce382559366a7c1f8bbafb4f9e9e7dec6434b100ff4e1e446c4bba88 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in joko-ketoprak52-sukiwir (npm)
Source: amazon-inspector 1b4bfb8a1fb52498204a20a00105747d60d700b54f0984590ef0e52bcc1e6fd4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in joko-ketan37-apidev (npm)
Source: amazon-inspector 128bd546b85f3471f53426b2ac30ad0cc90cc2aa82b0b1226c20a032bb9d8c89 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in joko-kepok21-riris (npm)
Source: amazon-inspector 4627090b9eb03096776858949b16b86fe7508388622b854f7215b0904e173eae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in joko-kentang14-breki (npm)
Source: amazon-inspector 8e542de19a9375e05aa8df50657c547f57812f385c4accb701f791d47fa9879b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in joko-kentang46-miaww (npm)
Source: amazon-inspector c3e5e937da3c99112e967b43cefb3ebd759b649eade4e8f49ad78433cd903360 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in joko-kembang98-riris (npm)
Source: amazon-inspector 6603333ccecff709b5ee609b8bb233d18464c07c9a393aa1d8541565bfc7245e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in joko-kemplang16-sukiwir (npm)
Source: amazon-inspector 31a240557950171e4016c8f8e262a8e8ea117116d582cf00aaf53cf044d84316 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in joko-kacang39-riris (npm)
Source: amazon-inspector e83bee0ced3b2f726cc8ce2d3ce622b6548887c85c519bb519c4121695d93385 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in joko-jus83-sluey (npm)
Source: amazon-inspector 2abc4ed4784082e22bb5fd258939d5b84cdeee2ebaa9c0670a6f2f7e4595f87e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in joko-jengkol80-miaww (npm)
Source: amazon-inspector 5a849fb9ae89556cf2241f47451d5d24f7f56aeb570a26465eeba2db787a91dd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in joko-jus85-riris (npm)
Source: amazon-inspector dab7a7a73368b12d90ccd3d6d34cf075065ed6ac0c580b2069ccf8ad30086b1f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in joko-jamblang67-sukiwir (npm)
Source: amazon-inspector 0b4de42be77f955bdf945556de0c5b1d47c62b62f7e999c8a7387194f9973ac1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in joko-jengkol78-sukiwir (npm)
Source: amazon-inspector d6a352d49eb4ecc356b17f7ad4894776c2d07e144480a9014203f72d4e79ef0b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in joko-ikan14-riris (npm)
Source: amazon-inspector 96a3d2476bc2ba01bb5544a15b0d34dd02ca2968e245bfac3b66c5fb6b264b00 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...