MAL-2025-144906 Malicious code in meteor-cross-env-promise-comet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fb174c4e59f8d419248b9974b4055adfa5d6c0cb04323bb9ba94eea030294ac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149674 Malicious code in xenos-cypress-ursa-callback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17c7efb0dfd9e0a603887b643409249147387ea0015b6b38655d3aa6b494df52 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chakra-ui-indus-castor-betelgeuse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 559b6440cf8de7895eaea748dfd87f39f1aa885f93498362d0745a609484be05 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in helmet-rate-limiter-superagent-umbra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4ef1f11565aefa5ef4b769785a04189915aa6acbcbe8bc7e233fc7c62924926 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in deneb-celeste-grus-winston (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f133612cb4622a9ff368b70b9d7c1d3a32e82cb081c81b65846dc2f0327e20e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hyperion-nightmare-markdown-pdf-gravity (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69b544b8a10799f8cfaa90d200b1ee4bd48eeb09502f92148037a2541cd7d678 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bellatrix-library-ganymede-equinox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a50182cb5ce9b9afb3fed1228d3caa54c2a273e7c272ab4b15aead9a5fba33c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in iota-gulp-colors-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8431bf4a128360ee6043e7c52edf66bbce754f42425ffbe398556515f7563293 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in norma-cz-conventional-changelog-changelog-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d72c73c24102a1ea8e836ef5ee6740a543a940fefc68ab2f2ec513b98fe55f57 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in regulus-phoebe-corvus-cypress (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0151e5068dc5bce9091a6d205c89061fe9513c7fc09dd31cd433c06dd39012bf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in castor-cordelia-neptune-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c3d9a9fba927e5ca91691c321ca12735df0f533a460cdd3bd694d732f2b364e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rollup-ceres-nashira-fornax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25c4e65abf401015d4d4213a7c0ab52a1a20d055907783400b40e9a89447b753 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in toml-websockets-dynamo-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1db1651cee518f3de25dc819fe2db60afd978bc23699dd5e3ec6371b5530357b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kastra-run-script-firebase-blaze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc401c10920d96d579d2722526875bac5f60943ac975fdf0410ecc87dc3389e6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in yildun-command-chai-airbnb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdd633c6313d4b9c28b2101444cb08386db672459f194e7ba9bcd01f32efb480 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nestjs-react-bootstrap-dagda-geckodriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ab8f182e93ed124506286a8c5600abd6e108c7e992000981c8c480610039da7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jsonp-sagitta-proxima-adonis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa753953218b29386b71fd301e0f77b7ee751f4c3fe229d8ada58d8b4905b054 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in reveal-md-miranda-levels-spectron-webdriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c748cdd6fd77c1cae9a437cd5bd642282b813a08cc3826fa783055b41a5c2d63 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nightwatch-pino-pretty-publish-nodemon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2a1c951fc5746b594ffe7ddccf0b1e29860605ad3eed07f5b638f0de0cdecc7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spica-airbnb-pino-nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b41bcb691b34ac087839ae6fbecee64c8eb6f8039658ce929656436fa9030fa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...