MAL-2025-161154 Malicious code in mutr-sds-basta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1e653c09560e8688f36e4c3b97dea353a462611f1256f0e8b452402c70b4a28 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lint-staged-sirius-xo-juno (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e17f64d7f2c40a23b7372bb25ea8330f1abf134122c1dbca12aa0be572e7394 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dagda-convict-nova-mongodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52298d621a66fe7a0eb02409e2c6b190bcd68b50065d077d4702828ca83313ad This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146844 Malicious code in pulsar-run-script-redis-convict (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e468e8345155c6e22043a1a762bd73d53b966d686db21505c6709bb62b81bbe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143725 Malicious code in iota-fomalhaut-less-loader-repository (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a0ec46f8e20a1a9d4098250978e555733b981be3fecc9e2382809291a2de13d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rest-arcturus-io-spinner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9d0b8686eed7092e318656016dd7a3307ce443b16ea6fab1ef179d685a0e7e7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143238 Malicious code in helios-procyon-acamar-andromeda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b1c78fe3d841cbc1ffd9d974980201998e5adecf1b4254977630cd35006ef5c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in oberon-materialize-markdown-ignite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21a2083b4fb84ffe9e31011134778fcef6d65245910619783432fcfd3f6217af This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in winston-cassini-mutation-orbit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 401128304cdbf7c072836cf82f8fee13b009ff8a7e027f96937fde57663b0d07 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in morgan-leda-nashira-dione (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07d301d71e3f3f31fd91652777513e2b2a75170dce59fa2f3c8b068976afb993 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in betelgeuse-test-wasat-iota (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2627a3d5478cec46a418310793381c869e3537e1fe33a28306aef8abc0b44db1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ophiuchus-chakra-ui-release-it-concurrently (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 269b02906e9dec6236ba4177faf7870709eab530f6e8617c44e7a1a2b31716e8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cors-antares-kastra-blaze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80905b19348dfe1664b0090e7c37f23b84afb3cf803191684c8a5a86dc2daed1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147747 Malicious code in scripts-semantic-release-galaxy-apollo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dc373eff89a8346915f7e86bdbe978bb844ddf27580d6e384ee21fd6bf5e29d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143200 Malicious code in heka-apex-firebase-hyperion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f41f0381091ae082e9458edd8f1ec765ed4a9a451424985ffabe6a53d08441cf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143433 Malicious code in husky-xml-kastra-await (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7f9c2bf1b1dde395f39bfb95800a0f14b8fd95f06ea2bbcea41cf3fddbcc839 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146262 Malicious code in pipe-dynamo-nodejs-stream (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa9dac7feb2c94e2e98f30abb6178870ede5b7ff4102a2d06705e6c6e7f5490b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pino-jwt-spawn-koa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9482fd8c422e0686a472436bd8fe8e417f9f1d3974b41d159021dfc6f1a2546a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in canopus-proxima-yaml-puppeteer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dab40b667df69aafddc22f108f2d07a25f78edad369a93fe46cb65cacb2f989a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in toml-changelog-umbra-rimraf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42d8d922c0f5886f548454be277f67c9149630b0200138d97c82fdf16e502c48 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...