MAL-2025-140737 Malicious code in charon-thuban-axios-thuban (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a62878091dd31f40a00204cee8df3fe4229ddcdc28f34c23574e6211e92f6ff2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149445 Malicious code in weywot-remark-titan-auth0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44b91250cf24f7949b14f40c0c24691e6116caa06fea0b5b25539c3f519bd116 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143127 Malicious code in halley-airbnb-toml-jovian (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a603b9adafc76612cfcb012fe930172074af1ff062c4df5f8bdbf21c25fc845 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147776 Malicious code in sedna-miranda-lyra-semantic-release (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4515a7c2f104b0e68f888aae3fadc0ff3cb0d87097bd8d5c7e8f3f2ca52d916 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143417 Malicious code in husky-fork-child-process-flare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c28ab319aa31277e720caa8ff1e8f5df6fae0d7de9751935ac84c658e0c026b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in query-ultra-foundation-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5c34a8bb4f140d8b1c22dc64d5bd563c9a1e102e0768876da83550b8f89365f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in docusaurus-html-webpack-plugin-jovian-geckodriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4609116949d2888210bbbaff7fcc70912b1a68c57396897b64487418f2b06d3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in restart-terser-webpack-plugin-sails-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab66765aafe6a3989f3cb70ae24310d06329d976f3d1cd58ff9e5d22b8c2401a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nodejs-miranda-socketio-enceladus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eec621e6726eab4c97228945d899750c0f1ad4ebfd72f119c1b2c51100b87228 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jest-venus-fetch-firebase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c734b28d4aee59abf5e705cf6d757d1ba1faa5d4ae58881d3cdddfb0b0d70ce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in json-prettier-stylelint-leda-halley (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 311240dbdb6e2255d7827b9b6f16c5a351db73978700f59d2e023bae65445316 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in epimetheus-triton-lacerta-altair (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c84f81d63b2a3391cebfaf4fdbf55f15d5cb41615b2987e447e4980502d4c8f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in iota-orbit-sirius-pegasus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eca1f11bfc43988fb9609e136bfb0d522a271e885abb7654c703b5719af059ac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rollup-global-indus-testcafe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79361108aed6e40411d643c21feabdfd09d5e67872f95b55d72cc8c3d6c230da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nodemon-chalk-standard-cordelia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bc33a1334c3ba3564f3045da232e4e02b45ad806f336f9e1fab0efe8a107f6d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nodejs-javascript-winston-aether (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a08759811e9231c84fe5943c1d82297170a12b450089b82e470c7d2b2d89911e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nodejs-mongoose-dotenv-mongoose (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c38ef3e18883f3950ca328b732c4c2367c7cab4f3dc2bd8ab24f4775d51cc21 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in slidev-cypress-blaze-upgrade (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05e0f7b3a54e7c3268f82dcb5c3e36d3c579c795e7da849d6bd79a75b57b653f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in forever-andromeda-sadr-barnard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c25d29d91f79f19cbf57e67c5c4e2b0a700835050ceb880fa502657636e89fb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in toml-commitizen-vega-upgrade (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df6681488f2f6863e00ad9ecfaeb147850e462a4e95077c0e213b618430038ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...