MAL-2025-142700 Malicious code in frontend-carpo-yaml-hyperion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47cc2702bf536ac942f0062c5a6c776da5fc9a135b93382df362258e62dbb975 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145158 Malicious code in mongoose-koa-jekyll-promise (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e938303663a27d9f806911acfb796bc1db37b7e755a0b5ea10cb0f1a0132e6f6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147065 Malicious code in react-bootstrap-lynx-neptune-docusaurus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 510019b85afb9e4e1728b2f031dcc773b97174840ffcdc884eab7dc011eb029f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148434 Malicious code in sync-telesto-configstore-javascript (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54779bbcb4eec02fabbaa36234e8bc29bb9dcc9fb6945cc112b983d94e6650c8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139237 Malicious code in aether-playwright-wolf-child-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05a9fc87fc510023d5891e89c4d64133639279668388245675c2377c1388e4d2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148892 Malicious code in ultra-eslint-plugin-levels-titan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be4c0e6023a4a0a627300221eeb5bbb3e70c0f49572a3e51aaf6d797bd0352d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139548 Malicious code in aquarius-sass-loader-morgan-unuk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6cd9cd586c41afbeb3e8333ca04a4240347ab41002bf5c1c9d9665191c9c366 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147182 Malicious code in rehype-remark-sagitta-prettier-plugin-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9621a0c04e54a0924449a78b942bf69d5d4428434482ac10c175cad19d3b0b6c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142818 Malicious code in ganymede-regulus-nova-auriga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfcac39e2252d7a98dfd7aba9713cfe91f64f7993e4b430534ff58eade376655 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143199 Malicious code in hapi-winston-halley-fornax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ffb4375f00365f06b4c9ac37c81f570c287f324505bbc1a3f0f648ee87cba9e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144639 Malicious code in magellan-gravity-rehype-proxima (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07de925dee10238a4852a1837422b54d8a5857069876a5f9a55053132923bd13 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147066 Malicious code in react-bootstrap-magellan-xanthus-scorpius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 863ae5bc0172f654995249a5a80e3bb2e62bf625d2f7599bfb7ff3166df47fe7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149099 Malicious code in vega-supervisor-exec-taurus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30b36eecda9d3527991832751c533eeff3acb6d01350295eb3cbc83637ae07ca This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in halley-enceladus-install-carpo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b1252fa09c8e3f5e289551c8ef29c7568a2f3a15d611100b3bc20fc8b90dae2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in algol-chai-babel-meteor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64d9f8282d541ec1f5afb3ae6868da6de795ba3b4d3ccfcd7ded668aa567b1fd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in puppeteer-polaris-rollup-plugin-quantum (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e91d21a5dc53bc564d43fa8a35261a81ba823c57bd5edb97d48a0e60b3f8d082 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in terser-private-ophiuchus-cz-conventional-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be3405904445531c7ae1d5711a260447cb6f598d121e2ca8ffcffe1a2aa7713f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jekyll-fetch-lyra-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 629b4fa570a0d70e8141464581ed15f4719b44b0916381a26d46e3b4a2b7a6c6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in metalsmith-warp-lacerta-cors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dce56374fb88b40c9774518f1f30bd60741869f567c8a7eeaf5fd5b0024e250 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rollup-plugin-cosmiconfig-axios-chromedriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 887089f1756813ee1281c518b378e9496822a0ef1a84f21866e1cfaa764c8de8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...