MAL-2025-140115 Malicious code in bootstrap-optimize-css-assets-webpack-plugin-jupiter-unuk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 426f629cc0e9636ebadfa27f808f9a88aa73a6c3c25a7270e3812c3e86aaef18 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in semantic-release-sails-webdriver-mocha-npm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ced23e9d6990208bad63cf4763ab6e387ae390922047846eb57c6b9cfe68bc7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nodejs-miranda-socketio-enceladus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eec621e6726eab4c97228945d899750c0f1ad4ebfd72f119c1b2c51100b87228 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in apollo-halley-cosmiconfig-cypress (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 398cbf2aed0a021ce9867d71a7b7748b8c94de42d368fbefa3c2b94326010a89 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in release-it-command-express-pyxis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b66213e307184f45c99d6f5d88c283d343d707ed28fdcc2cf3fd36dc4dce28c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in local-run-script-ophiuchus-global (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bb8344fa0bf708a5d389890c5264e3d60bb553c221469e2dcda9bf9d1a03281 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in csv-markdownlint-npm-grus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e73e26256761af7533779186f15b847cda32f6523b5e531c46bdd00586275461 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in reveal-md-ganymede-chromedriver-dotenv-parse-variables (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05bf8e69492fcec22cba663947e29cb7dbc03cf4ad877ee0b9b0db4d8dac3f82 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zenith-got-mocha-nconf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9afa733062f7441efab83dce9ac40ecef18f9055a003dc18b310395041acc520 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nodemon-rollup-dactyl-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2b432f0b0c2f9f89aea56397185205c9ac09c7aba0ad4d26bb0190b556c801b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bunyan-nestjs-gravity-atlas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a2945766e719b272c5befa7d59051355b159245ccff670eefbedbfc435046b3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in local-aquarius-callback-airbnb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0de1111468dd157dc24fdae11e31d4d41f4cb9001bc90e624802b0b770804ab2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in readable-pino-loop-nightwatch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44b3b852e1f3038c98d784c5e0f10bcd609953ec9ebb113fca071dff047de237 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in oauth-nextjs-winston-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f33e356c375a07eb1114356bc140ade2d78b93ddd6e18f333b96d5d5ba5afee0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in firebase-cressida-commitlint-subscription (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46504f4252ff87ca260f5be757ce7ecaa3594bf829bd535705879fe64ba14f4b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in server-apollo-markdown-install (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43877fef46565713ec332e3eaea0f240ce8a94564f81b080ce2c75687fdced15 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149535 Malicious code in winston-yaml-webdriver-mocha-repository (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f2aafd2c598a36174246ed2a93655569ec5e247c8ea65d7573cc259e57155be This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mdx-schema-chai-foundation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62e20418c5cc5d9a5995fe03f673118b061c32c2def8904ddb0f8507709f4343 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-safe-elektra-build-octans (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ec8ece53180670f01716145c00b47d9987080d41885ae0c91d2bae340e797ae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in loop-scripts-koa-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b8bd7851dd59a18465c76cea03c8ddae5cbf1b88a7a03c3e87200dc9451156a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...