Malicious code in spica-postcss-init-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c0dd7516ab206c60ecc4fc90715916d1522813a27c6be01c8e4d65420b4f695 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mongoose-altair-carpo-release-it (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 098ba0624983e816986795af3e5a8fbdfcc6ef8446ff26353af8a45c6ef0a8fe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in got-superagent-passport-chai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0230d14e2b4ea76e2119fa0b86c46d053d908cf42b18a75e56f3b15296d96fc8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in indus-astro-materialize-miranda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8474eedfb266d52c3e1dfc1fb588e3b8fd8b8541a1b2a946c7249acdde5c6458 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in uglify-js-bunyan-solis-neptune (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a18bd78465b6b510bce2ba9729f0be6011d5aa701b7932571ff00e95f439f01a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-122516

Malicious code in reveal-md-epimetheus-impulse-procyon npm...

Malicious code in dactyl-titan-cz-conventional-changelog-mocha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9ebcbb6b401a4e9dcf5b69e8d8f3e68be1a9f58d56f30831dd47a44939695ea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in acamar-aether-bunyan-postgres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f74c9b7b56288393328f2847aff7f758279283fefc2bedfab71788cc1b5a460d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nodemon-chalk-standard-cordelia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bc33a1334c3ba3564f3045da232e4e02b45ad806f336f9e1fab0efe8a107f6d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in juno-superagent-stop-antares (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 987855d522deaa8e2efe1c3697d32579dd6a94d8373a06d043bec7b5547b0efb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in airbnb-colors-sync-hapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7fc7d0428c018b9d34e73281aa3acd0df3ba2771cef2f568249f03b9b919a9d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nuxtjs-hydra-betelgeuse-yildun (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 818dbd79dab4e20db345cb9b61bf63e37ad4e1004bd2775e6c89313fe9e80290 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jsonp-barnard-wolf-thuban (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33b72f6f1b19f9f156958d490ca0d6d358ae7e033f2904c41603c1671e55d1b5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in exec-firebase-iota-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94332727a2aa8c02e041f58ca774af62ff4e6988d385e78bdc86956bf5f7f31e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in iota-triton-writable-cors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1439b571c88fef6fd5907adc4a1e16f9fb19de36f7e8ba79622ff79a3c34b79b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in indus-install-procyon-xenos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81c4c20f3b514ef8beb31576a698a1ff40f0b35429dbaba3b2cb6943a420f581 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in airbnb-karma-lynx-lint-staged (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e05e1e5527ea26a244d15e0aa5a7e08fb9668682cb3c6840370ec54b8aafc6ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nconf-firebase-async-mongodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa716ed80e114bef0b9b7b9d962f271faa21538c3e9d5b98a4731097134c33c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in supervisor-pegasus-odin-proxima (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5eafa0494d823d7d10a713b9c3cde8e4e9386a1dd4780a78567fbe9315140e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in run-script-halley-reveal-md-passport (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8bc545e0cc9cb920011e1a91d885f625e749eb317a503a663ccac9a791fdebe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...