MAL-2025-146396 Malicious code in postcss-loader-galaxy-kaus-cygnus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f5605ce3f0a50e3f5b0c6a7049fc8fd2af1a76c911b137becc0bba57bb16761 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145629 Malicious code in non-blocking-ursa-postgres-cygnus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4a3fdd105ee5de4d8319f3c1fc42c4e5a68d5c3842e883524063669fbdc8004 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in scripts-build-ganymede-altair (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dca854d6df3b48be4282c2ab22c37905502a03ba15db1d06cb12e79768d8d2b1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sedna-standard-element-ui-wezen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7ce0f3bac1b17d65b475013075f790254b11c5a89bf35d1a2c597f700d9e42c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in barnard-andromeda-indus-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 304c748107942127c7c1d160a9a483e68ef0f9a68ac202f5da185715afdbcda4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lacerta-magellan-sagitta-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7daa5ca770f65cf9f926a2a05bf541b135aeca414fafdefcc3362e1a5941c1e1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phoebe-publish-gemini-kastra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c346999cc24172ed14d568998d9240bf3ca1888626c6c643f1881bc8aba87b96 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in despina-standard-sagitta-norma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a8b128c16f6b38c7b05d3ab353887054659ab8b044b6ec98883887ecdf90940 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cypress-repository-rimraf-nebula (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 120b754154b050cce9db7fc61ab5ceeebb7e8904a40f6acc9e1bddec0640021a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jabbah-spectron-webdriver-procyon-enceladus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1135c573e6af1a5857f5370756b236e890589ee9f51d736363bb5287226b1f55 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in readable-eslint-config-fomalhaut-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0ee5f3555c71216bfe83a0a339abf659a970f21b1d22f958daff0045e8007ef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in proxima-request-forever-optimize-css-assets-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed41735893bd2e6c37f5d184b83eee13799a2223968480fb1576efc6310eaf8e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in elektra-acamar-equinox-comet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 030c3556c12040d6b9df31c7bb5424883e630cc2ee0b0e91d4b4a629d6d0b567 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ophiuchus-izar-kastra-weywot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 328a62d2bcdce3b83d55aaaba84a4dc4cdaf49d7d16d020310bc18f9c6672de5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in odin-altair-ganymede-xerxes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d673e550ef24dded27e21a26ab4bc7711e16dcc672c74e4f3ab27c334cddccd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in npm-nodemon-docusaurus-scorpius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f611bf740b7bda1998c55a63b663f09236dc36d7b462563c560b32c8ab17b270 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149055 Malicious code in ursa-electron-builder-helmet-foundation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69dab14f9c372453cd1539810554a152dbae1521576f8135bd17dbf90b01ab50 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143417 Malicious code in husky-fork-child-process-flare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c28ab319aa31277e720caa8ff1e8f5df6fae0d7de9751935ac84c658e0c026b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139784 Malicious code in avior-sedna-adonis-hermes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92f6a18b05bbbfb0b1dc6c244b97d5ce8fb073ecd38758720a74adb3d57de635 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144854 Malicious code in mensa-halley-bootstrap-rocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea1a18f9f0dce5f00570338378868ef126968870597e34b985e1d8bcc4b1bab8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...