MAL-2025-187917 Malicious code in mantle-achernar-kinetic-whitedwarf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c799008fb34f7cb2fa52e045f7f6d7471d623dbbafec1c8b02a121ae895ec8de This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186007 Malicious code in carpo-lynx-sirius-sirius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a61b45a733442dad2bee78073691142efef575d4be2352de5061b96005b2b5f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in quick-serialize-small-bash-delta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83195472b40596bcbf33039302c5a9300ee72e68e9ab21557558e15d8f28a353 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in run-script-zenith-mantle-blaze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c8bc15d6d61c2cf729f00787cca8ae37164f36691b012e1c17ec1cfa919423f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ethology-ophiuchus-slidev-markdown-pdf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c2f40a4b4e432786056beb60a86f5a1aae0069cd01285d04f9d578da7fe9d95 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in server-callback-css-loader-archaeoastronomy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71b3bec8505261d79f060d4853518f6e4013a766f0d6093c149d679f10912456 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in deneb-multiverse-augmentedreality-phoenix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c3bb282553929ded53f031976182f596ae80de4f0259afe9086d8c43ffaa49e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in perseus-carina-duplex-bellatrix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82db29da799b8923adf9e0105b02d015268632fba539c6d56c55e7300b952ba2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mongoose-docusaurus-fomalhaut-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95ce0ee2156f5fb26ee09bec3c4892bdb6c84b3ddfb7955c1a8b3bff442bd6a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in quasar-oauth-perseus-prettier-plugin-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28472317cdb1fc5348cf5966fda3fd7258b958bfe4a734759408ca8b0ede0160 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in await-husky-electron-builder-superagent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a86a1bbe4cecbcb8f3590b941a42cef3a87592003a2e822f176e34decbd8f04a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hydra-markdown-pdf-resolvers-postcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3b797c75fdfd25ea211ed69e79105dbfa687f29b61dee7b5781593c49413254 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in optimize-pipe-signal-dog-index (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 973ce0a16ad8d5c1f09490cb1dedb8466884a064e94f7f49ef23438767ebc54f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in asjustmeteai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 488a12e01a7d9cb98b0bfd0c661b0036427ab1ea7bf5bf5c505c75751d268134 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in perturbation-bulma-mensa-eventhoriz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d51a9c3a3b80be94feb024b2c0609f78f69db01e5b8cb7bfd485aa825e763b56 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in orbit-html-webpack-plugin-xml-docusaurus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08fb8c907f7e235373242f869cd54f573229f75943e3b713df6ab822fa2142e2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in perseus-tectonophysics-iota-xenobiology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1657f0e5dbccaae1e34f55c0c23f8d33d107b19aefd6281a229da5a52a944ac3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in helmet-pegasus-non-blocking-phoebe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14468cf08644b774f382415ed7ea9da2eca47006b532d6e5389e4ad5a9f45130 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fomalhaut-venus-pavo-update (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 329c73a08e9f3032f6b513ae004fb488440b7b7fae9069985ce5d0cf7d9d76f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in geckodriver-slidev-protractor-hermes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29689121273e19b8aee711456742cc62e141bbd4ed84456d5dac711fc1273ca0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...