MAL-2025-186453 Malicious code in cz-conventional-changelog-blitz-steganography-lacerta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 730ff285678049eb66e80db3988bb6718e03f59c281d112d5768eb338419befa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189804 Malicious code in taphonomy-commitlint-kardashevscale-loglevel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 695ffb95ebfbe4a2099875c019ec792a3a780ee83517b91b3a5b79d3f44c0036 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in carpo-release-it-oberon-halley (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2d9a35551f995b8ec1e04118cfd9e74e6be2edf86c3664c5404ddb401ab0918 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sandbox-scale-promise-unix-resolve (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9ddcf410fd06e2ea2f2269a667bfebbb5ab12de14aad2c9f47ef13f257ca503 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in postcss-loader-hapi-publish-event (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f30a4b6ed232f3a0f88e9b315c00447a3e16a47c406a885a51e8efb67a3253d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in json-apollo-rate-limiter-cross-env (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4041eaf381f192fe6b5f0fa41e0d62e7c44bdd9c3dca76d45a758c432e541b9f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in futurology-fermiparadox-parsec-publish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7932b00db63a52a64e991976f6b489776b42c5b992ba035510f6778c3fcd33c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ursa-inflation-atlas-taphonomy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f08f459b286f25ce6361ca667b880bc5e7084907c298b11aead0995d00ae6e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in brane-halley-solarnebula-stratosphere (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9dbe993ab0d2060aad81f817e0d23ae578985071a1a988c2fa1c1cd10c224534 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in user-double-signal-node-upsilon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 331f615747fa4552139398bd5bd8ab96fb56c9ffdc6d81e14eaece427b08e5f8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185463 Malicious code in antares-bunyan-apollo-deimos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2c64bc39e1aa26b38456721f22e94693806377129dbac49a767a3dbeb61f372 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188513 Malicious code in paleoclimatology-node-sass-asteroid-pulsar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44d11927628a582b335587691209c5d269ac29f4ecf3d85eb1612706326c4974 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185859 Malicious code in blitz-materialize-link-lint-staged (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cd6558b44eec2954b20bb99ebb1a7e8e455149631179d6949c5569bd11e1822 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188710 Malicious code in pino-pretty-yildun-express-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 269ed87702f42dc45182c4c396bd4001c18e108c66d5f61fd4f3ac96adeee437 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187894 Malicious code in lyra-warp-dactyl-interferometry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0443e66fbe5e2851fc2339642f366487cc1173568243d8b77eee088e5e787a0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186621 Malicious code in dotenv-safe-jovian-astroinformatics-ablation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86a312ee1d39ce12596c3d43387bd9eead6fec93b1060c13fe52416868153972 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186315 Malicious code in coronalmassejection-terser-zooarchaeology-telesto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f17a3906bd4a11e984c0df47d8cc68a8a7f61cd950e0a6de37029a1ce951b7f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187442 Malicious code in impulse-dependencies-spinner-figures (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b1c5ba732a67d3f66094e9fb848726d7544d82bb0de3c82c8ad2e54e6932cea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chalk-stop-indus-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87bb8e1129a1d5a199fd42030542e91c8c409a534084d9519532cc4057e92cc4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in csrf-callisto-hapi-nextjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3353f2b88309fec3f0a2db16bc2c7dacbf46763f6ef7ba45dc6a3742e6ec2f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...