MAL-2025-139272 Malicious code in aldebaran-cressida-morgan-kinetic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff470efd34f66915cb29fb44804c26b3905d8a9b494cebe1dcd75a1a0d180f61 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141160 Malicious code in corvus-miranda-hyperion-quark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8720b589142023cb9122945e30accbb3c3b29cb91cd61bba41cc5f58f61547d5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149042 Malicious code in ursa-apollo-xenon-europa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector edbb8ecb72415ce0c0623a1d88fab94233dda638e82c410ab6280b3fd621c2fc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145458 Malicious code in nightwatch-chai-nuxtjs-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8d5d5ea2f7c4831b445a53c4b04bc94d73aba09dc480a3bb8fbcc203881eec0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143399 Malicious code in hugo-sedna-element-ui-css-minimizer-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8cbb809a5a462eecb562ebf259496a3417030ea7068dd248d7c76664b049056 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jsonp-lint-meissa-dotenv-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17cc0a698c1725ec64130dc90c940bffe2905c6de5e4f97b0c17e638e24af4b5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in colors-version-yaml-eclipse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bd2ea773ceb2fbdf90046a80e04b7e6be9d95b5dc63b05f4a9a71313a7ba964 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cordelia-cressida-quantum-dactyl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27661cfc261a53a02a9701df91b624e832b0af05f032fa459f8ce8ed27561fec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in schema-zenobia-lint-staged-postcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac5ab3b7e3bfb60ff149b1b0a9bcdf4452c85f6e105a4ebdc330ac5e3d541976 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146174 Malicious code in phoebe-pyxis-cassini-relay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e46047fa723bea944665489dc9ccb6b9f98032af680facf37378bc1086f485f3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140289 Malicious code in cache-xerxes-upgrade-hyperion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 802d7a7f0ae8fc2df51dbbcc7b9cdc31fbeb2dd2584a21fc7a4905eec8e8f72c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149121 Malicious code in venus-reveal-md-chariklo-readable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcade5cf30b3a0402a16ed5fe6a8901df4d3127ad009edaec8965926104d55dd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sedna-pegasus-graphql-jupiter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ba74f15a1ec971342125b46b02655ae8d84ff85e5b0090ebee93b6711e752b1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hermes-cross-env-quasar-duplex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50b866027887b5ac9b2135f67ab8bb33027c601c32e209811c78c6548170512f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in corvus-forever-ophiuchus-chromedriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ad127b135587bc52e235a692a553f73b4d01a14c9268345dfa2eba252211511 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in epimetheus-apollo-commitlint-config-angular-relay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0da73a2148d09e8d12fc54a7f894411b1f1f805497bc1d98cacc8c61e64adf08 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in yaml-arcturus-postgres-jabbah (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 328014f3eea8432fccfec2d92b8ea016e420ef7d3d74b9c0b304d13eabee4d02 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in janus-winston-mensa-sadr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 725ef081ecbc32e0eb2fc6dabac94d89410f091e67dd4de94eb0795f5c7e7db2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nodemon-procyon-async-gatsby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 406323274fbbac08d27d4f8696c166bcd7c5e3cb75bf00e2b4894f6ea9e2bed1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in corvus-puppeteer-eslint-config-mysql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a339ee93474eeaf05bb0ccc6e79ce00d741a53f99c8a1e41fed151288239494 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...