Malicious code in sync-jsonp-less-iota (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01ef6cedcae0b8171fc191b67ad90dfebd8ac6e394c7ce662b8e558b22e9d56b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gatsby-vulcan-lacerta-alphard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ee152af5e0dcc5068bfc21b3ba72197064d1a82c2e97851c04f94b589799f52 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in janus-apollo-alphard-acamar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 150d51d65c1cd9493101771d11e68509daff5b35998f15e358c5b04c72e6604d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in google-csv-bellatrix-chariklo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97d3973375d954986667ca7aa33aa2b77e079ce52e861180f1ea202f3071fdbd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-124796

Malicious code in mongodb-csv-hexo-kronos npm...

Malicious code in jabbah-nuxtjs-spica-loopback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14c6404a455bb29d3f9893290050e6e8982e6a5dbc7c9429a4f25827345da287 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kastra-nextjs-tethys-acamar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5237449ddd14cad0c7a757cf5ecff71002c9c6726139843650a1a07f68385093 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in typeorm-antares-geckodriver-auth0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf4a23633e8dd4341205570ff944f50dbad00022a4bd0b1d7ba92d0e3a6d8922 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nuxtjs-polaris-google-style-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70a059d4f6f8befc217803d2bc110b92360c80662b5242c31399896692d4dd6c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mira-perseus-delphinus-winston (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 370b99d13baa843ec3e6b05367062a9a8f526f0778000ba19ff3e22729a31288 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in solis-antares-altair-wolf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81f3108b52e57e82f5819ed94c64af83d8e0e7adf6bae76b340b85ae6f7ce636 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cli-geckodriver-aether-morgan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18846f63f307e6c3bd0ab988ed29bd9c00e3411f32d9b783a0b8feafd51e01bc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jabbah-foundation-auth-sails (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fff1c97910c4a0a152cc3a17478ed0e622af9e547e7e11a92d3795e6aad004b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mysql-commitlint-json-standard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0023ee1ba06a2691819a2310fba47ceb9d79051089d1ed1ce19b0e5382973aa7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-114093

Malicious code in eleventy-zephyr-radiant-subscription npm...

EUVD-2025-123478

Malicious code in postgres-perseus-karma-tool npm...

Malicious code in install-spinner-dagda-fusion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13c279966d85af2513de0e15fb02e3c285bc0569db9813fc0f1d2194166881e7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vulcan-leda-auriga-antares (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5086134f060f78e8bd2666915ded5575a2b0ac781abe295b75d87751eb90fdc4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in alphard-cluster-reveal-md-sedna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee22bbbe9632215a2c3c8b8578c6322a0cfb2caa0be027efb0af754d7e2e82ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in flare-antares-altair-jest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba1dd19c2038ff973dd2b4ea0902b25852272ab1db03e4ddefba38fd37d87ec5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...