EUVD-2025-111817

Malicious code in leda-style-loader-pyxis-izar npm...

Malicious code in aquarius-sass-loader-morgan-unuk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6cd9cd586c41afbeb3e8333ca04a4240347ab41002bf5c1c9d9665191c9c366 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in arcturus-toml-carpo-postcss-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8147de9a6ba9892bbef8fb92f6494108d9eeabd8b916bf2676a4467a322ec14 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bunyan-less-loader-tethys-playwright (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 24cbc3a3cc8e63e76f314b7ddd68857182ffde9e092dd347c91d634fdb95c116 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in callback-package-tethys-less-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 174b66dbf76fb664cc59ea69deef78d6bf12640a1916ef82cfda94247d890896 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ceres-oberon-less-loader-proxima (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a97612f43d862992dfeb7205cbf0420d5859286fc81643bdf378cdefc549545 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in child-process-lint-staged-less-style-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f62ba95efd3f3ef97d0e9b721dde58dd83c79c4eac6b6f8b08e9fb792462089a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cluster-css-loader-halley-cressida (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3390f5930409dbfea7ffedd9530a9a061ccceccce84acc295cc9a2a934d2c47 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cors-schema-nightwatch-postcss-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a3068afe7dca873227fe3f04e64f38db980de42d0e7cc3bfc9bd80c41ccff06 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in corvus-tethys-elektra-less-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00414bc558ede2504999ccd82b0749bf8e7114569a2c2e502313eae1f9ec0a12 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in css-loader-gatsby-oberon-got (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8a19af4e44ee7bff5a71b4d40822481fb8ccc14538ae978842ec212c121d58 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in css-loader-octans-acamar-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b5a0eb27ce8f5a2dfcaca555b902c33e0adef4bc2fe29a0608fab6b0b3a2244 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in css-loader-soap-elektra-andromeda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e02bd7db49f120b636f5d8a86022af64e2403f9c6397fdaa301235a9bca6c2be This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in css-loader-spinner-hermes-hydra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8302d0741db7d221e02f8e9ed2a744e8586ed4f7241cb1249ff6f197772e806 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dagda-aquarius-postcss-loader-aquarius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f696dec9028c1ccf5ff7366778658b3df225e2bc8174ac216fa5b5fa5a39e8a9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in enceladus-css-loader-nuxtjs-eris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c483e9bf65770e7a71f5e4ead851865362008112e6ac859753ed4775f66af56 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in event-style-loader-quasar-materialize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f3f6d6b77dc2f520cdb7ba4f987505cb6723918edc979b94239282bd9a3e49a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fork-less-loader-stream-spinner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65f983e20b23c6c3ea63bfec0d0eb328ca07ecf008967e2c5e765651916732d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fornax-mongodb-ini-sass-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d92b178d3023eba948ee956d55dcf075ba19ba31ed8962ead5726e6adc9edbee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fusion-apollo-style-loader-envconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81e697bff033a44314f01620f35bf49c622e6ce1d0f971103c8b1871fda65d10 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...