MAL-2025-142706 Malicious code in frontend-jupiter-writable-dagda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ca3ce2a7f57e4a4c5d993b8e33302ae1c04773f290a3bb65bd819552cce3b6d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phoebe-jasmine-betelgeuse-duplex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 868bd2cfd9d3ae551d1149b5c520a17d12b7cd3419667f53c2c09909b9312d8b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in janus-sedna-quito-cressida (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18d2f6ab7cc7f3a02476d6987b9a26e390aab826b5862c454f17f47af1b7f31f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jabbah-spectron-webdriver-procyon-enceladus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1135c573e6af1a5857f5370756b236e890589ee9f51d736363bb5287226b1f55 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in procyon-meteor-chai-xenon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bb8f6159e8cfba287e21e8c7a1a2797408c83744710c77d671823be0b6fa884 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kastra-version-sagitta-taurus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb3ad7629526512c8e8094dc1e6a642a0a45b7f8f0b9d35bcec3a523d57cc4a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in izar-phoenix-dione-mysql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd388f1bad0a203ae1f12e85f920bb6662080c27aee8cd6469afca975f10c002 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mensa-fornax-dagda-testcafe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1a30f012f70b9c04326a3eb8049c9458b8986a6a78608bd59de0d84977266c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in loopback-global-levels-dorado (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c51156dce9de4ef059e365316106ed44ef797131009a2bda0f1286fa23f7a3c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mocha-ganymede-dependencies-hapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fbf7f214a0fd32e6dffcfce3cd4db712ae91ae3fc1f73988bdf26b98e0d7c66 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in juno-epimetheus-selenium-child-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be603a6ccdba311fa78ba451f8072a751787808a917f9b9d7795778a7aac3627 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phoebe-bootes-aquarius-sqlite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dce10c3e3d36e1b8880dd58b72e16290d55fc1cd5effa53d778ccb201ffd9ad5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pino-pretty-bunyan-aquarius-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d3be5ea47811d0b857872514e29ac72bed37f671a39bd04d05eeaf989ba52be This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in package-prompts-jwt-ophiuchus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6c5591b1f156b3719d8f31d98a00071866e36084c212033dcb994b4a06cbf05 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pino-cosmiconfig-eris-perseus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93dd9d8fc57cb176b04e7b09587a7b5e36c2d4b77c0db76abb41f2fc0bf77da2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in parcel-carpo-cypress-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51611f11cebf50b4cdacfccdd2e1979e08f8252c810d6cd9c4f167da72720ba9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ora-halley-equinox-helios (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e17eefaa0049e9ad89efa16d16def14a0dcafe1a3cb50d8e977ad7885dd1feb6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nconf-winston-rigel-mensa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57818656989f84e68d0cd7543eb5cd75f822505d7833f4de2347d782cea86674 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phoenix-markdown-javascript-sagitta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 194fdc7c89040402f84c7f588132dda2fde733d422fa806aa30af0599cd5f431 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in library-eleventy-start-semantic-release (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ef5c3375e9382697062795f0b29e5fe5a516d4292590c3003a1e2eef900faa4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...