MAL-2025-170102 Malicious code in upa-lubalauvli-ilualu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c83acf675b2ed284c34baadbad1683f8605cf812c454dd51579e8f5ff4d74f48 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-156124 Malicious code in ilal-poke23 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d22b20da043cb8b2cd22696336a5d04253be6300080e943db0e410caf6cf1ecc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nodemon-middleware-non-blocking-eclipse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0911c18dba18f41ddc05e9ca6f4eb53d1a1290db69de8d120a48d8b7b16b0d46 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in graphql-enceladus-meteor-jasmine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f303dc4fc3654d2483f1bdbe2bbcd9922173b5307487abd9154297d5ce82c078 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spawn-kastra-got-json (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41b681ac37012ca91d6377363d6e5a8296b01d4e42c7f49d917d4e368a0be7af This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142091 Malicious code in epimetheus-betelgeuse-toml-node-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac2853f1e0cb19851812839610ae7bf708341ec62a217a1006c8db7e958a9ebf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140012 Malicious code in betelgeuse-transport-phoebe-io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35c309f95b3ad5cf936b5c7b1d07fd290e8da345f646add5d57cb058718f3ee5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144004 Malicious code in jsonp-pegasus-metalsmith-dynamo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0357063f5ac8327173d6d17b484ae86c65356bf7045fd583f4ea653d3758cc61 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143232 Malicious code in helios-google-venus-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbdd3ca350cc2d89867e35e9712945365651243ee77bbb151092965b2539e17c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145879 Malicious code in ora-dotenv-safe-nodemon-postgres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5f5ae1a3c4741db4980aa3500c4358afd09c3b49bde668079c555bd0fe85862 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in socketio-geckodriver-child-process-exec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 992519d57d5eaddeba7d0d897fcfd3a9290cc2d2f620518393717a638329adce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143136 Malicious code in halley-dotenv-safe-rehype-cross-env (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1331a67bea2e24c847db87b08e88619af87131e0e5509a6b8796b8d4eb5d99d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146223 Malicious code in pino-meissa-izar-nextjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59f4f35d77fd9a52a0e902f6c0cc3434a805974cf10624cc7cd084a5eecaf839 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145186 Malicious code in morgan-regulus-xenon-gravity (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b88c30f23ade6e1415484a7e9c1f68a5da86de1d452c1653f5cba3405c60358 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in auriga-eleventy-venus-neptune (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2496a63bee7beb3167c28e31284ebf45ceda5dc2fe54d573431cd05f1daf2bf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in await-sqlite-betelgeuse-fork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fc60883362f96ce17af77f42c511cdc772ed4ff9c97acf2447b1547435cb5ef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in blitz-hyperion-leda-supervisor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc31ae9cf161ca7962555f9633a5ace4c22399ad5c4806c8975a2c1802e17953 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bootes-nebula-cordelia-slides (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73fd084dd542b21def1987eedf23c9ecc771d99ce6b923f8b0c800a2d77ac8d9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bulma-airbnb-node-sass-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b05b2ac08868e6c7fd670b15b48fec5a3be342154aa5b9a86612c8413c16242a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in callisto-miranda-commitlint-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b34dc3e8dd56356d3f11ca37b5a7ea84a6f80b94cc36ced66471e8b1b501997 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...