MAL-2025-185512 Malicious code in aquarius-babel-nconf-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 367d06fdbae8de2b7d6bcc68f6b13999fc7160d92484baa01898cb3fd84acfab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186264 Malicious code in compress-water-cluster-slow-cat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 562f9b245b30c1699990c7a16e89d8683682dfec4887a6054b862b4e36fb2163 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189436 Malicious code in selenology-tailwindcss-cosmogenic-antares (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8930f5ec5584cebb34ad1297b7e483e8cc42152b117d3b097a91ef8766b46289 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-190228 Malicious code in wasat-betelgeuse-mini-css-extract-plugin-cosmos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f72c3967bfa61a9dcf238d33c4284ce2f1f41d6b3f850a019d161f7672cf5834 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185789 Malicious code in betelgeuse-csrf-aldebaran-json (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector adc4d06a9a2a5838b3cfab17e7d8abdd29e52f75c1327cdb199e805a5a420465 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189829 Malicious code in taurus-interferometry-global-ultra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 423d2fb9cd944e08525cd67c996f1e7bc14d018867030474945cf79ccd4d9b79 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186475 Malicious code in dagda-spawn-selenium-vega (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 577b28c0b18bb61c9dd2efacf6fc2620489f0e87c664c1ceb83b6663cf92d7ff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-191941 Malicious code in zakuraweb (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 aa544044c8a113eb904f97650e8132de793d3bab5a7328a3714495e3f6a2283e Importing the module starts exfiltrating Discord tokens --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in itale-dci-fngduyge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49ae4ee65de2da1a72f4a9ecae4393c1589abc667c295e355c67940d3242da6e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in astam-ifst-dikg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90022fb9e51aab356734925aaf6de982075f0406473d9023ed294ef58b67d036 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in manu-oib-givakisaois (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7f8c3a402b364ef8b8c02e6590540f77ebace7d2165189450ab75c9dbd9d10e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in avangi-olia-iaiai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47093a7d8448c760ea60c35f842c7e45f15ea4b3b9d0f0e4292175c4c700ea29 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in odasv-kiuu-bofauffsni (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bafe2ba65bdffbca4b1c025e2a54ad713667dd618400e18bb0461f202de65a81 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in modiov-kifni-ufavcseqiuban (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d176eaaebec8a55e200b042befe310d2a10e4a39be440450767d3ffa20ef9ea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in poliaoz-aiko-akuiun (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 796a71960504475e06582cf8a7efbdf718bdabaa2f3a4e1506102e867f2249f7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tunis-kit-bogavi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57898fef6929070fe1a668ad66a7e0eac73eccbffb35ab0ba2140f5b23e5789b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185095 Malicious code in sonic-ks-fudvitifagagafyaja (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c71522860084275c5dba8101abb6d530bef331b8edf0569b0f44919ef8d9783 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in modiov-kian-avumangaiab (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccfd3c964e1788fbabeddf31cdfcae54097b7392ceb36af96ce87646c8adcefd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in inda-fodja-gugoa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2381618fb04382cb6b6ac8f5c237372ed847fc0bb1b5fd82466d27c28637d739 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-kag-tgvb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 248eed230e4efc313942713dd46334818cd9837d4ed782c4be3bdd5dc1694b46 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...