MAL-2025-188467 Malicious code in orbit-luna-indus-xanthus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ed9d865a656c770e023fe92f67cb64974da1cbe3fb0141834bfffd8c86df97b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186418 Malicious code in css-minimizer-webpack-plugin-brane-saturnology-quito (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64b3a15e647657f89676e3a0ec4db2727fc5da627f8ec6d6e710edaec52ba97c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189528 Malicious code in slides-convict-husky-kaus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b69738a724e0092e0205d6285478e0784c458bdc90564307ce801699beb7d7fe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189820 Malicious code in tau-mu-good-beta-kappa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ffc911728d84781a700b5b9e706f5e42e1d50b3a29e8c8141b254da2aa124f4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188065 Malicious code in miranda-borealis-nova-dotenv-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91dfceb96c2bb4d76d95411a0920184fcb12cc9d7aa77518302845bae0a3e6a5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in terser-subscription-kuiperbelt-cryptography (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 532199655a42d0bf32e8d6cc375b714b6858799c46c26c21f4f6bce0f38d60bc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in star-route-query-export-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c20beac557c34a749310f87e0f1b74f8044729c51c474177886ce1fc005f2d3b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in umbriel-zenobia-sedna-odin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68b10880c1028577aca2324bcb02cb17d6dcafcf9da7aade9173f0cd6991bed7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in server-nebula-cosmiconfig-umbra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d990e48bbacd130f5620b5b20983fbbc4001f0ff552a7c6e169141a13af346c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in toml-ethology-cordelia-carpo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18524f8a4185f881f243daf29ab7f4540519e31f88063d8df886042a8f651320 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in less-loader-react-bootstrap-cosmicray-spectroscopy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34b22a3237ae7e67de2b1fded90e8aad83a6fa3a88ed44ce7d4329367a38aa5d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in library-babel-meteor-kronos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a9e462c051102c828b4d50e3973255ce834bba491eed99cf30b6f877f08521f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mui-delphinus-castor-magnetosphere (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 750dfe89f0a2461b38a8de1045bdda9ffacb48ec68c2e64e2b316ceef914074e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in reject-await-hash-try-try (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 623d2820b9969642342638ffdc496c9ef3853f209f297e48f6c68e39d9ce22e2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in abstract-mu-kappa-authenticate-decode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d08399beef713d804598e044cce8cba325e7407564b93be665a8a65372e6fe1f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in puppeteer-geckodriver-redshift-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13eee7e60a6dfa0e4c6b1091d856e3478c1e254bac890f6a2f95ebf2ccb71ea6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in decompress-deserialize-nu-new-emulate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a6edfa42a45e2a85d466aabd86a81aeba6ce9ef832a86836a8e5ff913e5fd6f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in forever-iota-callback-vulcan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2f60f3a13bf834da1f6e7ea40da360ca3b541224c8dd928490733f69f44b927 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dorado-hexo-sqlite-postcss-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a4a93ae9c0b359cf320351a3af5fd7016688cc60265a5c221a86d43cd0faad3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in execute-long-pipe-file-encode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5dfe837fd34a8b4469ab59da1615cecd539ec907a7092c2d0566fadd5cef083 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...