Malicious code in leo-connector-mysql (npm)

The leo-connector-mysql npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the...

Malicious code in pino-pretty-technosignature-biomimicry-wezen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d78551abc317c974c87d5054e9be17761bb59010ff189eac4ca579d528d32c3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gatsby-enif-tachyon-prosthetics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd3e1fe40b9f4663cd8b878d886d2d8206a84740ad4a30ca7055e0b73b99ffd0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in proxima-thermosphere-weywot-websockets (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2244dab451a96c625aa78d793fcb3ba1931ffe5080498587c46c6bbf7f5a3d62 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ceres-augmentedreality-iota-transport (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa891b4634ede31623bc0fcd42bb4d3d610a695e74ed18b4ad58f1634a9830dd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lacerta-style-loader-mini-css-extract-plugin-less (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 222914e44e98bf610164e7ab4d3b3240a1bf355716c59e8661864f5d3de0ffc6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in upgrade-mesosphere-slides-sirius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a91873a5b873df3fe99ee0ec6b44cc1d4008c8bc74886676ad22b1e99b5abe9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in javascript-css-minimizer-webpack-plugin-geochronology-foundation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 541d9f2ae859b256fb3d8578c48df0d858a1f1fca17072d9018dfbb8b3c0c6eb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in subscription-interstellarmedium-toml-neuromorphic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94870bef41024d316470dd53ab7a4f20aa757f5e14a2b389f9389b45f02c0f32 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in supervisor-cosmicsilence-kardashevscale-ophiuchus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9573fa09b793a27dc60d132b1c9ae19d3c0b44531783b2302554c24bfa8ed91 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in registry-pipe-version-chariklo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb83a59ef222bd5e5aeed91986f77fa69c191bb0dc1819dfd9eb913e08908872 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spinner-command-solis-taphonomy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f267dbc36ff88fe19ca4064f576af5fcdb398942c5d4cfdc639f21a86ed1935 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in yakutsk-luna-nova-triton (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1247a887e7b5c2f9fd964d4f486657e8b0b2f0cb3db19d32b6971e95515ac6f0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in visualize-validate-array-hot-analyze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa5405559277835b28bc4c8bb6db51998aa22c4fd91d1ef31c819a28799cc347 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in commitlint-prosthetics-altair-magnetosphere (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60bd81e041aa9a99e170a706cfe17847a5bb8cbbb63413017b209781241701fc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in supercluster-command-betelgeuse-style-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75c4312f9a8f4944f7302c2d84d8f462d661b5c52a2451094345926045d0e847 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in proxy-cache-beta-iota-water (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62ea476eadee6f737a5d5939604779845fb47a080e38fec660f39ad6b1e818e3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zeta-permission-beta-short-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 150e97326cd1d07028267b635aa4429aa6fd26cd6649457e7a1bcf41e904538c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in proteomics-electron-triton-child-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fc38110ed40ebd893261af27643229422bb7c0c76d0a9306749997e8f876c73 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in local-cz-conventional-changelog-cosmos-quark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3e458e633b542e7ffd2b0e112aabcc898fbf435cc944028d735d657c238d16a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...