MAL-2025-186248 Malicious code in commitlint-config-angular-forever-dotenv-parse-variables-google (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e8eabd8ef0a60fb9207674e7219976cda9db0950935484582aa5086ac905614 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187537 Malicious code in iota-geomorphology-rate-limiter-jasmine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 346e3847a3afae7b06fc9b4ad231de81c16e9d099a34651a5080fcd332454451 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-190377 Malicious code in xenos-chai-changelog-helmet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d57e7d17a62121725e43a4dcb43c230c69a82ebb28081af536c4aefb51532125 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186376 Malicious code in cron-tree-query-unix-report (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f34a183643dd8952a10e6cfa7eadbc3debad2f90787679d22a85f961c815e5d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in capella-cypress-stream-supernova (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c056bd7523c0aa7f57aae01ae6f4600c1fe975aa6052ef4a4e77bee80f16db18 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in centaurus-neptune-css-loader-lynx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0908ef85e2b7fe9360387bd155ca3c553dcb970ba235726eda56533fd71a985 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-178534

Malicious code in hermes-version-mdx-yaml npm...

Malicious code in eris-perseus-subscription-iota (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b261a9fb861a3208da1f028fe4c2ebee2a90df3ce636dcd100ab6c0f0ceb8c2c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sagitta-antares-winston-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ddd0b309f243a59e5c481a498f75eb1c403e12809499a7c5b5fee2a091da4f0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185773 Malicious code in bellatrix-proteomics-meissa-redis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3398288809b5c874c3bff20243d7fff802f24671a300ef3bcdcd8e9432b1c921 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188334 Malicious code in nodemon-kinetic-native-cassini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db0a0e399774059c86b18263f553a0c4e86eb2e437c88f3ce39f78d204bfe905 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186163 Malicious code in cli-cordelia-chalk-redgiant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a90893c3d7e4d4fa1c3626b55b27eb9e39f5ec83bb10dea8c99465c4493b68b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189109 Malicious code in redis-epimetheus-jabbah-apex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6772a2748dfd8052df353660cdf46ee191aee541abb93639ff7612b651bddb89 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189314 Malicious code in sagitta-javascript-process-telesto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 192f71261f706f28676541bb8ebc25a651c6bcd39f95de4ed5e6634af129bbed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185585 Malicious code in astro-helios-nightwatch-sagitta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c597e6e94b0dc9824b4353d492fad15b37f4cfe800812bcf2c4174a1e8e63b3b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185938 Malicious code in bulma-yonder-acamar-ichnology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79a0b30f20cbcb9805b0e311cab20ec5e156a5b6ac5cd32cbac5550cbad49875 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187322 Malicious code in helmet-blitz-izar-update (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7274aac6f97ba8fd1f45ebb661eb0379a9e13bb52fc4ca45314725f2352ed531 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186125 Malicious code in chariklo-areology-changelog-arcturus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ea57974790ac6b25ad20f661e626cd0d461ce58dc78973b65902a16c6c65e33 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188404 Malicious code in old-decompress-scale-throw-user (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ac07058aa278241320c2b4fc18a86d94746457ed24ac97143b47589a18f1203 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-190091 Malicious code in upsilon-decode-long-socket-final (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0962f6e8da2e588484b33fb5c75f660402e645c56187e064048d31ee6b4a4e7d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...