MAL-2025-187956 Malicious code in mdx-zenobia-altair-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a4aacf4eaaadb9bc25062197eb2c1c852cdbbeff87ba8577ac4680b6deda5b2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in try-stub-yaml-query-awk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64d7afc6d4f0fe68228645490da6a101c05503ade1edbaa923ccc4560f7632b2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in user-refactor-cluster-transpile-eta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f18892cb120efd30e52630d809cf1105bfccbab7aaa211fe691e458990281176 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in triton-perseus-paleobotany-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a50047252fce66e072640cd3c4b7303162f58edd8f8ab3107fdfa9cd848674d3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fornax-janus-fusion-css-minimizer-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b0fb880a3bfb6b4d32d650b9778f2bab22b66cda0b72f0639a80bccf3fcd8cf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in archaeoastronomy-lint-staged-polaris-dynamo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7ff83f7a5d6fc103e22f1e1f849ed6afdf59b479690cc50d9b75086d617db1e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in arcturus-phenomic-glaciology-promise (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5041aedc9f556fa5042866507cc67da08df40c63bc2232ad8c83e43644f6f999 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wavefunction-crust-interstellarmedium-bootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04a6fbe9eb989b7506f8400b8bd89e2de56b6b7b55bbda804bf9120b204df0e4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in serialize-stack-omega-node-authorize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7aed9f916c9a8d5708c398fd6560a52f8c9bf1bcfe4803b4d74ac4eb04317d5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mutation-augmentedreality-archaeoastronomy-neutronstar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d350f2ae2d91b828a2e264f7f2d54908fc2de495a298a5dc6b69b023837e517 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nova-singularitarianism-warp-redshift (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c0803ecf0fa0167d661a7e276211b0421fb37f0f5a88da29890880d932bd520 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in html-webpack-plugin-deimos-toml-command (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bb045f13fdeba200e83090bae2409a07346335c9f563b24f275cd3404d87132 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hugo-mini-css-extract-plugin-ophiuchus-convict (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ab15840c7162a1c78bb10f8ff332b175c7f6472daf912e63eb81d372dc63e1b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pegasus-pulsar-plutology-astrochemistry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7119678a00523fb454aee015dc8349a8b07748c775b4a6d48223cfa6da03a0d8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in theta-validate-meta-air-cat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21d3e186b062df4165b4ff6124f4467a91df506dc840e45e44a67191212c48ff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ionosphere-triton-selenium-janus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d954d776ae4202f524932128d3db461e6808e8922852e0d2ae522b55c38c3597 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jabbah-pegasus-umbriel-perseus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa305b62d59cc4fef7b21f6541fc211cc89fefd1acd2aeaa45a6ccbbf4c0ef70 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in repository-reveal-md-multiverse-quasar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de52f7052500891977e9b92278627f7cabde231989ddf59ee96489c8f19bf65a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in moon-new-cloud-mu-cat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7213659a3b8201c11de4613fcf1612a6f3efe3bb58d2c69ab5633e9f00655521 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zenith-geckodriver-rimraf-non-blocking (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d36e1b47c6a8e5dea570a5dcd3fcac95ca35a52c52436517afaf66ceb9522d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...