MAL-2025-148726 Malicious code in toml-websockets-dynamo-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1db1651cee518f3de25dc819fe2db60afd978bc23699dd5e3ec6371b5530357b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in enceladus-betelgeuse-nodejs-centauri (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a214e3efeb5ab890583b8fbdd9950fe8de1f2f78df13e65aaaa8892a71e73dc7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dynamo-magellan-standard-dorado (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd0e6537f0509af7748578bf409c68509f2a78dd654ab1e5524a808f98d675ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in betelgeuse-betelgeuse-unuk-buffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6dff0b97626e4ee33992315c9e755a79a6adc496b3debbe0e513225029979621 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cosmos-commitizen-quito-orbit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d396766edb0e28e3c059fe2e8744a122fa7919dcec485819019662e51aa0af36 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cressida-vuepress-nconf-xml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b3fad2a7701e8e70e72d43cee4ad37b3a44e2bbbc521f2696eaf92805c68b54 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in janus-private-phoebe-dotenv-parse-variables (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36e39b17f67223220fe63d32875adfba39ede6a56f0af2b1cac86d9c7bdb1d21 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xanadu-leda-bunyan-delphinus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8daad87c85d73df4e50cbf5ae6d7f071b1e0e00f8dcff8e225e8dd160c157a0f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spectron-cordelia-adonis-solis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 198cb3db9f112fc43c58a35b682b623e19bbafec7b8bc5425bf224e5905ee252 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in publish-prompts-dynamo-firebase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bc122cc572c3d2d1191ceaaf9b9258aad88aba7da7c0c08509fe79058b68496 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in centauri-nashira-command-proxima (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2759382bc8889aa98110e33c7872c4ddf1f73bdfd15d8b24712a94a12d0d9d49 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139474 Malicious code in apex-castor-gridsome-avior (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9838df6fb8cb5dd397939668d3b47a828bd69186f05c69811ecc477154c170da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in corvus-enceladus-lint-staged-private (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eae1829f498555d59bca2416201d75d19048908b4c7785ebcd0735c275c15140 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in proxima-norma-quantum-eridanus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 070c510d6aabd42a9359f70a061481de692e33fe124a1af5ee60137ae925f95b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145754 Malicious code in oberon-redis-luna-passport (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a7dc99789c6a0bc0bffec45b88cad0cdbd527b9612b08e1c1088d1d9fa367c8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vulcan-adonis-pino-zenobia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33067afa4c87ec451b549c0adead53a11a63aafb595a5134d16c9db2b554fc15 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141990 Malicious code in eleventy-aurora-csrf-semantic-release (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11bd61603a8d9897e58648607455671c4b3464648f4a3f11093edac31e0a73c9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141686 Malicious code in dorado-concurrently-process-helios (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76f20f6ca0676e9eff129a6b427fe940ee7a2dfa15373c2680bc0f47c155ceb8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144254 Malicious code in lacerta-warp-perseus-forever (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d114be1fc47db70d408c4ef91f54c6e59def37f58a787a130bd55786b6671395 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147176 Malicious code in rehype-meteor-pegasus-transform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73fa9c9bc7d00cb76bf4363eeb00bf670efaa50798ea6e6eb8f5a516d613d61f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...