MAL-2025-141634 Malicious code in development-solis-cross-env-apollo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2dcccf011de4fd5407fba424c68a7b956c9e40e3be6c84753b18110b9fc5f87 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146096 Malicious code in perseus-loopback-dotenv-parse-variables-ophiuchus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbf8a0f3e47fb0a4d035bbab3e87f2d08c738bc482b0680f20049920a2b45498 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ganymede-luna-solis-grunt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2bba943fa330cdb3d3878a5ffc09d78a6df573ce8fa64f6f6e36f25fcdd1d8a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in io-nestjs-ora-wezen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17c77f7e73b40dd673a983113e9fab42f1f437734bcec372c58f95bdab19c231 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in adonis-wasat-aquarius-perseus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5bedb60985af92275f2f3eefb5a8b036447dd8c91af4f79e47cbe9527440840 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spinner-build-castor-hermes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 421b20dd487b367106ab1d674e21d45f7c7271a8b88f3ca452f9b4850cb33f62 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in miranda-gemini-jabbah-xenos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d864893cf75d00666b5efd8501296d1581e7fa57b36dd0706f27e6927b104aad This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chakra-ui-gravity-mini-css-extract-plugin-chromedriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7d0b71d1eacddb260155bb4fac850e0b16be612054cb740d5d819377a0662bb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ini-tailwindcss-playwright-nova (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db4d7bac4b6f81457dac000a0c8151224d934771a01587a44703b404b39e16e8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in apex-aldebaran-sass-loader-puppeteer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df72001cfaa988d92bc5c2ea746cea8608e30c4aff68bfb47d95a8ecd76cd633 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fetch-pyxis-inquirer-dynamo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22460db8edd1c2b50d5e673d6618b9ce1467318283c7d01eff42c298a3541333 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bootstrap-gemini-carpo-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b0308cc840d6e4842e9c4e15e00d84558baf9204aa281f3c76b3e21112fff0d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in changelog-pino-pretty-webpack-bellatrix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9d6638b975900b50323b6e5574a6f9015943249473e10e8dd1479c4597b329c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in event-axios-elektra-transform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f727e46d13d502f5467c3574631b18795f11aaa68bdbfd4d14b263c00f2b246f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fork-betelgeuse-levels-pavo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 019cdcf865b6fa482e4057127c3724efff63c2661b5fdf4a6b48ab4086346ca3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bootstrap-chakra-ui-wolf-protractor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 269da6563955e8aa8cf275cece8a94fa39c1f1923c676949f24a6e7dd8eb9879 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in meteor-readable-dactyl-chalk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e94388570f96da505278819c6e146b9c7c3d8e2e1288e526202fbeaf4fb4fec7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in corvus-corvus-atlas-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc931c001a969e7ec61a962f459ddf810a83bfaaf634d60d45f190c942681170 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in promise-yaml-scripts-quark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c973ef3a15b1bc61b7b66e927c987ce656abf86b33d2140128bf4b9518333060 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hermes-configstore-eslint-plugin-express (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b3bdc04af03af34bd15360b61efcf854164c41b3154458686a6e8af98453a21 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...