MAL-2025-139173 Malicious code in acamar-dagda-koa-quark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91ca820a2561e3af6c3516d615cf56b1e30662bed8bbd8fd6d0ea9752e2b338c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142485 Malicious code in figures-version-carina-framework (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3513c6b2aae948d358ed83dec49f13f53edd21ddd9d26e0a8146e9d9bfc18824 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146542 Malicious code in private-semantic-ui-lynx-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55cb72d41d91df53f77987fff3f52958a85e6b1d5444c05279e445ce2e4b1e1c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145865 Malicious code in optimize-css-assets-webpack-plugin-magellan-grus-unuk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53aa5e7c9dc3d753d65b3a92dae95e45ef42619f35d4b3c87f3f5db8bc96069e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145275 Malicious code in nashira-flare-rollup-plugin-despina (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 389955c74cc9198f061797975cca0e77d5d47037a30efead28653746348f6c05 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148883 Malicious code in uglify-js-spectron-colors-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9ca0d32d9252e9391a2a4897d756ec63df61d8558401790307a3a375ad8f331 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145218 Malicious code in mutation-chromedriver-postcss-loader-proxima (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67015401d420f0d76976cc33d6c4b78a0808d48575356ada771e44ec5c50d631 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144678 Malicious code in markdown-antares-repository-apollo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ad31fea6b18f08c109e129807c4a8e2b90950344b0b6650cac6a40ce866239e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in redis-phoenix-dependencies-ceres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5017ce43682b298fbc06a8e5154a434e96fd9d7c7ef63c90c7dccb722695019 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hercules-betelgeuse-build-release-it (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af8705cb1053e89ed2a14becdd01e0d3d70ae1c4a565c3176eac6a1bcd5fd245 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in protractor-xenon-docusaurus-inquirer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c18e6ac6c775039d3c19b111ee39a4af9bcc6553cab555cb4dc856a71bf73970 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kastra-quantum-public-restart (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 124f32f9ca1bb4dec77e4c7dfd7d93584f92b71a291ca7d219c1c986fa6a3f71 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in express-titan-andromeda-shelljs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3db56ca2e1f597d46076e860c53c02a5d847424aeba44464086eb792744037e6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in transform-uninstall-octans-mui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f86db654307c7cfc379ac92f24a6d4c504fbc65b67b3f390aba1f04cdec2819 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in local-child-process-supervisor-miranda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b4eaf60354d0570e14c670da6c5ea1d1394c86e5490ab4c7cedb36b6413f77c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in betelgeuse-deneb-request-spectron-webdriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8764e4fcb6d47a864d8253ed1edf3345e21de2108d51e7d97edb476081bf9361 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cypress-blitz-typeorm-xenon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7fd9a3511b91a8ee654005a6e729410f36be69ce140d11fcd0dc6ebdc400290 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in got-terser-webpack-plugin-ursa-wolf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 058ff3c61f26380211cb6100a4dadc0e5377421f361087f0ef9fc8e44f437fa9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149157 Malicious code in virgo-grunt-prettier-quito (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ca017c4a5caa5e056c00e7d56901e72c07a0c8b5dcf92ad2effdaa6cd3b59db This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147445 Malicious code in rimraf-canopus-promise-janus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff23d07545c6bf65617bc3e8cda0cc53db851598795f0b98762db3ff60fef82e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...