MAL-2026-10349 Malicious code in nottuff22 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07035c6d64cbb510ca87260a3a3ca216e2ddfcffcb0ffba6d40ba9f8444c5e0f The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in function-bundle-log-validate-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a35fd81b2277d6c9f3ea3bf6f2675c20d346503b3d766e1488c95eb5d44700c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in winston-writable-betelgeuse-jekyll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 618dfd248d0e1ba6168342765507ae920fd0ed18ce8cf28a99a494f55683c3de This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sqlite-duplex-robotics-loglevel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f41fc7d49409f364c1793b954a916bbb4f8dd865b8617e989669637876bd85d8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in weywot-tool-eslint-config-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de32a7540b8c3b3d21739c05102b00d5a46e140039e3c22f2265e6addf4f43d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in scripts-chalk-nodemon-eigenstate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85ff9d37ccd592d5799db1e3e194c0c92dc1adedeb27ad583add87531d2bea23 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in changelog-prompts-europa-blazar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 146d38799b702fcf2aa71251a53635f3352bc26fc8c894932530f350b66a69b7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in middleware-mini-css-extract-plugin-ignite-json (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f3e82122591102f60da59a1022fd9f2b71682cbab9b037920a755ef505cc80d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in table-old-sun-await-decode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fff252c7519516e755af569d60b67bb3cbe754fc47400f464b2f0a3628ac9d4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xerxes-coronalmassejection-flare-filament (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3eba865e2a9d624b3c624e257f0dd29415c690c76db7f860ba2d9d5944ad28be This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in private-enum-compress-upsilon-omega (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 487ece3448f08f70c5b2da4031eff0deebbae4d9f304ce3cc6cd1338fefda9b1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in figures-duplex-magnetar-await (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3eae1d7027882b6a70265a27433bb8857139add8539583e992546d667debca8b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in error-error-authorize-phi-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b340179d411fda452870d0f9f487b221dfa2c4ebd9f2f2e93457306569405e42 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in altair-genomics-firebase-janus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d94b29e9713ad4d380989b0c0e6cdac4a84cf8357cd6849a4b7ebd32e68c9b50 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mira-halley-halley-publish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4d654ea2429bda07d6516d7e6c195f982a2f1fabbcd309bcdf070a02a7322d1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in orbit-cosmicweb-meteor-wolf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55dde82c55c9cbfa615d585f3c9f11e6c6955df1b478397d7c72db9dee3e0426 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fermiparadox-graviton-brane-membrane (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9262fc1c11bb2ad7e0e11f6605fc6d66a164fa4c863661fdfee73f4776ba5f9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in quantum-uglify-js-acamar-hyperion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45ca996a0f37fec8bbeb92598671e30801501dc4df71a3dbf77130fec73874c1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in archaeometry-europa-asthenosphere-run-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 261ee2052bb353eabb1fe0c480e76b4c843e7c52774ad71cb95ae7d1f1a41fa1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rehype-mesosphere-orbit-puppeteer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2e28a6ef17ceb60bba6aa7f7aa38fe00aeb2d6a8cebd70653412a6507744772 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...