MAL-2025-141915 Malicious code in electron-fork-mira-yakutsk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1cfca6cb2c335fe1f49ef9979402387599d2e54f4a5c4a3ffdaf8a61f577746 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in development-heka-fetch-deimos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fc34f1ad0167ae7f5840b129cbff77369019cb49cf1497dfc4cd4c540ecfb8c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spinner-winston-procyon-axios (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bed5c999fdde4bbc817fee2ff65419d8cdf9580bc8adca6e6021bd574123db6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ophiuchus-janus-middleware-grus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3afa7455ca0f55d55daa0b481bbe00bb64a2bebf660d267ff2e2621bef86843d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bootstrap-optimize-css-assets-webpack-plugin-jupiter-unuk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 426f629cc0e9636ebadfa27f808f9a88aa73a6c3c25a7270e3812c3e86aaef18 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in csv-subscription-apollo-meissa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41d87b5a1516b2518c854fa644e90a91b1a468ffd9573c8e3afdc5a5b68de7c1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sequelize-transform-jsonp-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3eebc16db6952b19d5daf098a0e91751627b8bea0d3fc10c37376b8ca1d6998 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mongoose-colors-private-metalsmith (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2016b08d398ea500476ae7f3915149632d7a439309de048e028ac5181209428f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gemini-postcss-loader-quantum-resolvers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 025ab4f53ac3540ff0cd2eb7fbe2d4c11d635f63020d4195a445991a4c7d4566 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in global-babel-sagitta-miranda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 280ac52a25aeeb1b2e6c9f3a4a230c3844f59f27bfdf1b084f24285bbc370d42 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in process-jsonp-build-concurrently (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c952c1fa34bfc6b5000796239edef4fc37cdec5ac23e9f43e9415eb5d6ec65cc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in yildun-procyon-impulse-electron-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb5dc2d52c81a763224f849df35a4f33a41297e9a714ef5b1fd7fcd69cbd8728 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rollup-plugin-style-loader-fornax-mdx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c6f50a3b799ed48afece1f3c0ca47c28c205b07ca81e8376485774124ef1ed5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gatsby-fork-soap-promise (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b73e7a65de6af65020a1c45f76329317657d4f7569beaffbfa56f0471cd8adbc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lyra-backend-spectron-webdriver-prompts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fa8744f950b29de6fb9bc5a67d5bcba756474741ce43ace4730cda738ab0fc2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sedna-leda-virgo-install (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 678811bc3418cea8107e8a9fe3f77efb20d7b071be856ea9696257f6c00d563a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hyperion-zenith-ganymede-css-minimizer-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7682f9c0a6590a2ca4e15735a1a4c7dcc1c42a813ce4231957fd79e906f9317 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ignite-puppeteer-sedna-rimraf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35174f4fc9f936f9c62e71fd6996be4ca74295263e938ba94323a36ce579ee12 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in titan-fomalhaut-node-config-quark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 490bf6813567ac10a53b55d8076e06b00264ecb8cb1e85e276c8576f7508bc13 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nextjs-phoebe-commitizen-dagda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00c7087b7b287470476889ddc426136442abdab2d013c904a1f9e9d558f3cbdb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...