MAL-2025-151536 Malicious code in abu-poke28 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45a5e73e8d3a12474fc70d282f922b3e1f7d6e3c76cc84d6cee349f596a61005 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-153685 Malicious code in billa-35 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 015a65e5f189cead34be4a53a7f7a0a43ab39845214b031cde11311d28bb8077 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-160995 Malicious code in mursai-bduasrt-ssda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1a3bb3d40df775d5bd7467e823a723ada5f9b089840510b33fbb70a2945c640 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-169780 Malicious code in uinsnu-lotiupomi-kilabarm71 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10d3a603b813b196fbe9b08f9c22364fe9c42f9c9a7a8606f7e4111278eb7920 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-152204 Malicious code in akanai-ala-aimava (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c36ecbc4af419bcc63b0f62a19c650cade5dd1354443b6163fbd1dbecb6127a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-163989 Malicious code in parwo-poke2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 346b225c378f3d2a7f8db5265c91605b98a7393cceef713d22a51c31299b6023 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-164356 Malicious code in poli-akilu-lunak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6b27b327fa653b4250c404248b3cfea580b06bea51eda4df1d9c343a374725b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-164281 Malicious code in pitra-13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bd6003bf6495411bfd30f3cd1b8504d514f7033c597ed2d201a7a94280f393c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-158146 Malicious code in lina-poke60 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3454ffa355326537152e2c8d86ea50a99c1ec17fec128303f10a01f43374f94e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in inquirer-prettier-plugin-markdown-writable-fomalhaut (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aba576cee921af273a381ecdd9f50e7948d25e4e33e507595011c39819ada9e9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in config-xenos-procyon-europa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e11ee2587ab693fa07da5ba1b7292c5c142aedc22b57b70a9ab70a5176f3aa6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-124757

Malicious code in mongoose-nextjs-tailwindcss-xml npm...

MAL-2025-149716 Malicious code in xerxes-repository-parcel-ora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f168dfe75d601a991ed88a1e2c0e94f4def5659781b663e517164c6fa7625a4d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149173 Malicious code in virgo-vega-zephyr-firebase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d02552b14dde06edeef7b347a403a0d5ea395a9d45f99471afc91942b69d47ba This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149355 Malicious code in webdriver-mocha-metalsmith-ignite-fornax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84f8d1b4005ff300bf85096906929c42441da1b129e398d9053f3b4a03241c7a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141261 Malicious code in cross-env-nodemon-sedna-local (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7316b299b527b2a7aca15f930a3fdfb9a75ba8c6418bd1cf9278ef08797cd08c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149748 Malicious code in xo-electron-builder-passport-dynamo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a4258594833b0af81aec1a8b3b0c76e3583e9312af81300ca476bb04013958a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ganymede-luna-solis-grunt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2bba943fa330cdb3d3878a5ffc09d78a6df573ce8fa64f6f6e36f25fcdd1d8a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in delphinus-leda-polaris-event (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f6c18328bd4bdbf2c3bc3fc6cd547b636261ffdd43a67ce494a8b2953a26355 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cz-conventional-changelog-apollo-europa-child-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a374729d98d86f3613bd69ea8a7dab54201ac5cb5daddc4823cca64866c8c87 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...