MAL-2025-149609 Malicious code in xanadu-run-script-ceres-loopback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b73720185a49ac547966c6348249905b0f45dbf95e66130c616a4d286437636 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147389 Malicious code in restart-procyon-apollo-playwright (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f42e3571477042a427ea800803cc8cce7743f22a2f72d8c43432ac8fd4a5c96c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149276 Malicious code in warp-ursa-kastra-centauri (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b98d11f27a0a6ade7b53275ff1860902cdfd84ce6a16f09337ebb7895eb0160 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143155 Malicious code in halley-mensa-prompts-fomalhaut (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 855e3f107c149e03bb867dc4f32af1a5ac1d3d7995590bfd0e43e51d71189212 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145116 Malicious code in module-slidev-webdriver-mocha-halley (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fd99e840b0e0e74e3caec7e7ebf1b86c170b0f4a4a307f300443e590e3d09b4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144836 Malicious code in meissa-superagent-nuxtjs-bunyan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5de55d40cec053feab657e806de32600c5da394aa913402b5aeeafd0c320485f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vortex-postcss-loader-auriga-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d10ce1ac30588bafdfef6bef36489e659c355f7c931e391a7ccbe7e2dd3712a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140215 Malicious code in bulma-indus-mui-subscription (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2dd578513e97bde5b2a543f6ce4f89225328ced75c1a8c735aff035ba75464f3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in telesto-aquarius-apex-restart (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93c69141f3d539b7b8b758d6cba8108ee1a7af3ebe626b704d04a5561d5f7f18 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144180 Malicious code in kinetic-ophiuchus-antares-run-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1029ceb8cde15110cf4088fc5abf83c8ab1b9dc7c09f0ee072aecf0241750f02 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in process-convict-auriga-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 925d7e6e7e62817f4fb1ca00bd1ee6a896852f2ae0608331368353a0c0dc6db0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in magellan-sass-loader-hermes-vortex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d16ff68d2dd7d1053bfa0409aff19e8eb4c277ed562bd9d6407f30d9ed4757ac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in frontend-magellan-metalsmith-chai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfaded5a35d94f132a6c8896414ddf1d3d52e9a23f4b571443e2689ecd34e447 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in procyon-hyperion-dotenv-parse-variables-blaze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b9621017bd79ae03f3436899cd4c34919e27db6e69c2be76e298958807b4f0a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mongodb-prettier-stylelint-warp-google (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5b98d60581def47fbffb1f138672c4f5589cbd194e37757ea4734716c294b92 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in apollo-sedna-jupiter-weywot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d988154295648e02e90f8606fd114f1c15ce7f2165fe2b4297393c771b18ac0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hydra-semantic-release-flare-mutation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6866ad123405c4b431cee48bd7065874421c495ac22c92bfd751939f527196f6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145302 Malicious code in nconf-alphard-electron-duplex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f56efbf37a7c3c9f8f377dd8543c4fb306af60ce943f5db4d631ad8a3ddc5a3e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in grus-jwt-transform-ceres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dab769d42a98e5e3a53c842163f9c5d812b5bdb3e8f41c58b8ffaaa433b7e9a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in optimize-css-assets-webpack-plugin-regulus-vulcan-fornax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c07d2b8b61c7ab9e326b8192138231dad82b035a739b9196b7f208ca7b97637f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...