Malicious code in element-ui-jabbah-chalk-enceladus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db3f9316015fa5ef848708130ef54aed0cf418b68094a0778716dae464213509 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in package-uninstall-scorpius-react-bootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a74311a498dc54021eb8645f2068701b117d54e9b84519e6d9a51fc46143595 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in janus-robotics-optimize-css-assets-webpack-plugin-jovian (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0793378417a72050f4ae70f826a2da21befcf17f43ea0e8d0157e0268e5eedfe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in transport-babel-dagda-electron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76e1c06bb58ec7b568f529051bd863c23ffa6e9ca7544112284c9f889effd370 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in virtualize-reject-secure-finally-function (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c2d4b6d8c1cf607c34947c1092356b4306699e741e0587ad20bf50524ad08a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cz-conventional-changelog-blitz-steganography-lacerta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 730ff285678049eb66e80db3988bb6718e03f59c281d112d5768eb338419befa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in apollo-slides-duplex-fornax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba8a0f7103bc28344b11048c487f65148e33abee3d3ff35337b6564cbb4ca14a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in java-socket-cluster-decode-catch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91f9d43e44408d07d0519e14906a4ab844a8bbdaef97555ba604ada50af6e13d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cassini-halley-jekyll-less (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfd52a72d246c6814a27d6224892b221e16e0799cabb54223fb2bf8d9bc57b74 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in moon-omicron-stub-long-book (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 615d1c6d7ad392f76870b9ba5fe3083a43808be1d4132f9f98bc7b60221d1ebe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-179174

Malicious code in elektra-jekyll-ini-async npm...

Malicious code in duplex-init-parcel-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac497f57073665d298fcc5fecb6ca9e77e45df4bf3dd82e143a292881ec22153 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bootstrap-semantic-release-pulsar-koa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6105ade3946c0a9b9a29cac5be3458e9ab96773616c0e664047e26dcd915a13b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-175588

Malicious code in webpack-dotenv-safe-avior-nodejs npm...

Malicious code in neutronstar-quark-dotenv-safe-koa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c51ac63c08154afa26f71278cae2c6f17bf39e6835d2f205cc35e304e1bf2f31 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in test-slides-bellatrix-io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bba71d4110a671fcb6d0cda97d9dc561e75c7fb386b29b0f7f2867f6d222056b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in colors-rigel-bellatrix-pyxis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c137eaed40b31b6152069e498b6ba1512a5e4a72eca57a6d5eaed47da47afb55 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in meteor-meissa-airbnb-outercore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f90614fd54ad4b93ad60971086709bbd736fc4d959596cc79df4ddb78e672937 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in redshift-deimos-neptune-yakutsk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f964324bd6752b8565f81793c10d0ab91313d89d5665605b85485952a2a4c694 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in perseus-cosmogenic-spectron-webdriver-meissa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f58a08ce2390b39ba0775e86569c351f7f8c1ac7780c89872374334fa4a05289 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...