MAL-2025-148559 Malicious code in terser-webpack-plugin-prettier-antares-tailwindcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd843ac6dced51f98acdcc930c20f0cad711abc9b239c360b831e0741fb4a329 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in apex-pino-neptune-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bdb944f658ed68cee18e920c32f8c3cb2c9810b5b8551c7e42d18eef82f85e1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in native-backend-dotenv-safe-mongodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 781f6d6927036e8ba7935aa91fcf468079fe5edef66c51944922fd9b13d986e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pm2-halley-vega-eclipse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ca1d66ecbafe685efc60a6bc86dc19f0340f58aca3c399a481f5b650b9817e3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sedna-pegasus-hyperion-puppeteer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 418431ac4801ca1c3e59bc16ea36311a776fb671e6cadd82853c46ab9a1a6fe6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xanadu-virgo-meteor-capella (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c761f603fa14ef1f4f2c2a192cb03b28359feca4a70d4e702e1fadd8d0c5e5e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in callisto-chakra-ui-nova-non-blocking (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5402bfb80d839e33636bc3caa425c4a6fcff979925d82401ba777c07e968c829 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sync-acamar-got-juno (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e8c8f713eb470a8a1e811e0988438e15cb9a6c94d56d3a5c17fc43081b7de36 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in yonder-kinetic-unuk-sirius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b70ff36cf80e77a42f9caa4919b3fe8f4af9895acea4cb758c43cb9070404d5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in weywot-achernar-orbit-node-sass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fe54136bb4a52990e8312c33b50c21425820079da86e6f1e7038ca5e0cad3e3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in yaml-nightmare-command-start (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22757024aa3a3d10664748a50311b9182e726fc4abcde0b54f43b750cb3c57c2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rest-tailwindcss-hyperion-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e22a4a72ba894fba6775542bbfed8bdd8794b17d73198abd401b0c381988505 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145508 Malicious code in node-config-gatsby-terser-antares (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 514c4395cec647ca12feacfcacdd7e1eb406be1f56351267a9f1f798a8f10ae5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140342 Malicious code in callisto-miranda-commitlint-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b34dc3e8dd56356d3f11ca37b5a7ea84a6f80b94cc36ced66471e8b1b501997 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145293 Malicious code in native-puppeteer-sagitta-cosmiconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc702e7575891810cd4a5ab2a9525d3febdae7b77ac6c98e96db321068d74f06 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in buffer-virgo-eslint-plugin-centauri (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a9404d1108d6ebae69e8398bde30e94e093d70c651f9acbb8f4610383a52ec0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146141 Malicious code in phoebe-bootes-aquarius-sqlite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dce10c3e3d36e1b8880dd58b72e16290d55fc1cd5effa53d778ccb201ffd9ad5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140047 Malicious code in blitz-impulse-geckodriver-polaris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0618ce967e87623c467784db730cc31e57def2ab1ce14eacec960f92e0a40d4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in reveal-md-mdx-geckodriver-callback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1e66a65f7c92871312341129ec9fa61d291bde4e1563ac61a81dac4d5fb3e7d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zenith-phoenix-hyperion-release-it (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 952476952f00c78ac38eacfdc6ad9794c14e54caac5c4693071065f2db63bc34 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...