MAL-2025-146104 Malicious code in perseus-postcss-loader-janus-gacrux (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9717f2f2ac452204d81ca2f4247e7b08e40a0486176508635e3a9a8711d883ff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141307 Malicious code in css-loader-metalsmith-rest-tailwindcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 005841e6161cc0f0146a62615f6eae5c47197caabf44e0ba61f55a86dabe8a78 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145710 Malicious code in nuxtjs-polaris-google-style-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70a059d4f6f8befc217803d2bc110b92360c80662b5242c31399896692d4dd6c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141306 Malicious code in css-loader-kaus-prettier-plugin-markdown-schema (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c520d0a4a8fead49be08d7a48aa69a9c1ca93479e5758acbfae5f2819a1c65ac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146343 Malicious code in polaris-galaxy-dione-css-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fe89b18978b330a37b7d1dbdf56eadbf5e873ddc9b39a4676a80187c71923c6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143312 Malicious code in hermes-css-loader-request-restart (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector adebda2e2ae5a06e49e1e41ee6fedb093a0ef37a243ddb9e28e4847013c248e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141177 Malicious code in cosmiconfig-cressida-style-loader-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94271e0ad39049b5652876cee88d242361da4605c8f8899fd662c77483075950 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144487 Malicious code in local-galaxy-css-loader-chariklo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62c5d995b2d7c1379c608222f6a930f1dd0abf83465e12d9acd14b9ec66aedfa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142758 Malicious code in gacrux-css-loader-puppeteer-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 126ffaafe4f44d319ebfb460879e4201884b8b653ca7ccaa102f814685839875 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147682 Malicious code in sass-loader-quasar-transport-upgrade (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f20c0ab48c9f324f56d5d61c41b6df53b2f9637aa4732f761ac74b9eda2b6ba This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142165 Malicious code in eris-chakra-ui-sass-loader-fornax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb06093fde32832822f36661642b3ab387c58a1ce995ae5993df5d4f745159fd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144243 Malicious code in lacerta-hyperion-cors-sass-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d9832123a085550ecf3b72f0ef1e00f4cde4b0f3289e6500118e6db913e8a61 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-116525

Malicious code in arcturus-toml-carpo-postcss-loader npm...

MAL-2025-143091 Malicious code in grus-css-loader-ophiuchus-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e043e95921a55127e5b044bc5645fc12d9eb1beb32ebd5b8c02459a6243966a4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-122722

Malicious code in relay-iota-sass-loader-enceladus npm...

EUVD-2025-113750

Malicious code in exec-sass-loader-acamar-halley npm...

EUVD-2025-123053

Malicious code in puppeteer-xenon-style-loader-xml npm...

Malicious code in sass-loader-bulma-eleventy-vuepress (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7a65711d39747de192ef67f184c4fd698988ff5192aa042598d43cce931d375 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147679 Malicious code in sass-loader-nightwatch-await-hermes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fca906da23f38f845d663f90e1e2e1181065ecb6793e3a00852fd12af5105e3f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148344 Malicious code in style-loader-wolf-elara-nconf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 797680a710ec1984e98fab2b185ba656f47c264af598ba861fce43bd6dd7b5bc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...