MAL-2025-147827 Malicious code in semantic-release-hugo-vulcan-xo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22669f1738276fcf0d0861f934453f7eac47379e02ba69f509ffde9eade5eed1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142053 Malicious code in enif-meteor-protractor-cross-env (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d280bc7059630f2c2989f4ae50b3817b2c915851150845a4b67d6caced3bf3f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146302 Malicious code in pm2-loop-izar-zenobia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 438fca0b19ba97c3e5e51640fa7210c3677d4e07d791cd09842ce448342e4bb4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145061 Malicious code in miranda-toml-xenon-commitizen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7dee0f69be118b6fa662a522d7925c52d6fd145c596702b2748315a189fa3937 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149340 Malicious code in webdriver-mocha-airbnb-dagda-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a53bcc020075238d1989eb6c590d78b229b53dc5d97c211b7ce2577909b8c6a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146172 Malicious code in phoebe-prompts-hercules-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5a51660212c8f8e17ba061c5d3c1287bece955ade4374abc8c6d27c3156ddb2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in node-sass-iota-hapi-bulma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91dbc27182aee5bfd31b5146e3edf1d1a806c781e33de5ed7183df2ea72cdd82 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sass-loader-native-jsonp-callisto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 721529421aaeef8accb9c675072bf8c91146dda70fecc5f4ea3d58ee3727c41b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in terser-centauri-celeste-bulma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e339383723734c046325b9da29001c1e0448f40a44486961005b3795aa6de17f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in janus-aquarius-perseus-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21b3084860f2cb8217adf7746c16acd98753704e6c2ba7267ba93cab716f9bc5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in typeorm-loglevel-xo-luna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0305db97622e16a28e033c862c4a5ef154902714f851182e21673992a75da64d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cross-env-zenith-dotenv-safe-cypress (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c706bc6f96881376f528379502aa33a8a6d66dfcac8b158a6a76b4407eab669 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in markdown-socketio-public-child-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a352ec70f195ef14fd8383e4fb7e003c0345e07520599d6941c970d1e98d2786 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nconf-electron-commitizen-pegasus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26c7414e208e7430f5a3b3b2c501f26ce402685f3fe6c97836993afba3b9dc4a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144319 Malicious code in less-loader-dotenv-parse-variables-ophiuchus-antd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29a1bbe9db986faf6cdb9d446f73fd84d8df8a0b68709c7614f3344107d666f5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144674 Malicious code in magellan-webdriverio-shelljs-inquirer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbe19c56bd6f39887588286da4810ff134f86ff606f2b2f0b78472dfcdaacc39 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147005 Malicious code in quito-subscription-neptune-ini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70002200c66b5b4cc0f28f3f46ad6a34726cb88aae438ffc6a091fe5ed4e7af3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139218 Malicious code in adonis-tool-optimize-css-assets-webpack-plugin-spectron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58cbea89b1590dfaf1c1a7c79d7ddd345b6fe22f88c4bc58a03e5964dffc81fe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144867 Malicious code in mensa-typeorm-node-sass-ursa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80132cdc461affdf7236191c74d5743e4c51d95a47f4df8fa13817817dda1051 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149740 Malicious code in xml-version-rimraf-transport (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5c8e258cbbd7b05fc7b948248f6d0922d4fcb8d1fd555abab444074a2c1a039 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...