Malicious code in atlas-radiant-sirius-ora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 693785909b6a2f6ec0efded6f239ca9b5178f141954c0652b3b1996fdf9303b3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mensa-run-script-got-lyra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68e554d69ad2e5681f68e16c1f18a1102a4bda354ed9b2632c50b09dd5ac6720 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-122499

Malicious code in reveal-md-procyon-comet-jabbah npm...

Malicious code in sagitta-supervisor-publish-bunyan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5de9a0ddb3ac825b2c032dd952456a12fa1dd6793f53dcdfedbc6229196f808c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in superagent-nightwatch-got-arcturus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54e9aec448506ac282ea13c172e7921e650b5cd3001c93cb67df38d502291a05 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rimraf-dotenv-safe-wasat-hugo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ccf289cbd205a33d2d44a901a7c9891a58d1e2ea2e6bcbdfbbeecc2e82fd0c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in await-vulcan-lyra-tethys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed292ee6936e0ee5a9a91b3777a7aa416b690ccdb583cd9256d7c33814053dd7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in magellan-miranda-element-ui-npm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 478640b4176788ec26ab2af3eaf3a84218eefd1aacee687df057a7012d20be8c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in postgres-resolvers-luna-acamar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11803c5a004b65527f2ef96e5f36fb752b13276d33c9bff1b5bc22b6479620db This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in enif-sails-less-meissa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 685f6778dd1f66ee5adf035170fbead67b325c14b41ea3a88427b4318720929d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cluster-ignite-ganymede-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14437d0aefae1e385cdcb8120bc09283f513bed896c77b0dbe800c278ed0f2d9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in antd-async-sagitta-mocha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9b06b3318adfe4495009692d720576dccbd81fb74b2e9c690133f67d70fa5ab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-120233

Malicious code in xerxes-astro-axios-rocket npm...

Malicious code in nconf-chalk-jabbah-gacrux (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1dd6eadcdd25956317466d57b244fea1c46e8e3e005f9e1041479dc608fa292 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140143 Malicious code in browserify-stop-sagitta-sirius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26fb65db83237cfff58b0e4af1e88a81f87370bff46c3902bb7ae2cd9deb6959 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149085 Malicious code in vega-callisto-apex-cygnus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbed3cfe68e3a74b472ac88faa9c8d2bf8dd3dd2614d6a118bed34e17c7d1c06 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147679 Malicious code in sass-loader-nightwatch-await-hermes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fca906da23f38f845d663f90e1e2e1181065ecb6793e3a00852fd12af5105e3f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141925 Malicious code in electron-pegasus-perseus-slides (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 671af7da2ae010d3996821b6cebc6aeeebef5043d6a5c62b3fe0d51ba287aa07 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146963 Malicious code in quasar-xanadu-ophiuchus-shelljs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b19c5c472f26b3df74519b8b1486b54c20f49ccfb9f17144362ea87c8acebff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142465 Malicious code in figures-duplex-husky-electron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dd4e24450b3ed544e9de8d12789b8ff3076134894ce25e574c7bb2996c7548f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...