MAL-2025-139832 Malicious code in axios-karma-mensa-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 410722a9393688cd5d9c27ae34b34821e0521572820fd9dba34e1116e0e430f5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139274 Malicious code in aldebaran-elektra-alphard-vuepress (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b7d22533d420b889973435226c3b0b684966479192d793f2fd1b62ba75ad695 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145311 Malicious code in nconf-dorado-blaze-cz-conventional-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14ebb80e8bf00b13131bbcd85b50a8f37549e9e91d183e6378da97c6b1847e73 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147650 Malicious code in sails-juno-bulma-gatsby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce16bf78b475495a344e31c5e78a2d193669d6ea105e1337bca03a3af58eeac2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144679 Malicious code in markdown-apollo-transform-ora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6db4084e821d24264fb92353f0cffb2bb312a7254a0f0a8069c3ffa278f517e3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140026 Malicious code in blaze-morgan-phoenix-scorpius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8f2730776016d8729f42fc992941a569b95e90a52a4a69625b5a6d6d7a60a61 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147173 Malicious code in rehype-impulse-webdriverio-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a4d663cc2df1cbf1299f2e5768e87b102d9f8ed51c2a21762524f1959577dab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146015 Malicious code in pavo-zenobia-forever-run-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d7b950df6ac8d6db39609449d99a532b9494bd71a5b800eae0c34f04ff47d8f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147374 Malicious code in restart-changelog-heka-eslint-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a4e9d744ae94327c698804fe82966dbc2351c5296bc154d46f1937541b8f1cd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in node-config-commitlint-element-ui-avior (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 931a3d65597b1872dce212f078d80bd723a120e7a0170a87d2d02ddbceaa1b49 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ultra-spica-yakutsk-hexo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6aa73545e08c8581da0785fb2c246e476c0ef4e4731c126452998220cc1746b3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prettier-stylelint-nashira-start-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33ebd32b4bf8b3a577c8241ab5654cc0cbfc3b39f81ee7cffe476b70f977a77c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in publish-parcel-mysql-hermes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4600f02aa1b42d0cbe2f15feeb35fe523685db00d9a4672ab4254b84fd88a5a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in perseus-kronos-figures-commitlint-config-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5eb27018f4f80f4bc6b981bd4783b7165ec1289ff35009e4723281ce7b6b0d97 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phoebe-prompts-hercules-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5a51660212c8f8e17ba061c5d3c1287bece955ade4374abc8c6d27c3156ddb2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phoebe-yaml-mongodb-umbra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8e80b370234a89e5ce2fe90376d18afeb01402b685d4abaabdea8be5893c4e1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wasat-procyon-semantic-ui-wezen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c618454ff76cff11e80437fb251c750fcb3143a8744cbf519a2690c43e433fa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in got-superagent-winston-rollup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0af67224d6ced20e78cf16853a62e8f18f7cb7583df01f4ed51adcce2de1bb0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in resolvers-forever-grunt-koa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09265b46fdf433576f41f7f12ba7ef773b4b643027adaa79185d07f1850e0e69 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gacrux-sedna-nextjs-nconf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e307a27a7c1667b7b33c2efac98354eefe51925d335545339cebbe0277a3aa8b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...