MAL-2025-161786 Malicious code in namae-nadua-maavwr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e02503797781102d77ee474a8d77bb623e017dc5c2fc7f74d2ae69e725695a53 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-157029 Malicious code in jelek-r-anime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ee14f533151602d16e016866b4d443fdb28b89c357a26f9f9402b6810235a60 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in global-browserify-pino-aldebaran (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96ee931d298510e62cb53d15bbd3d6cc32caf1a15481f40bf9b5643428d3e073 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sass-loader-mongodb-elara-norma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7dacee0b3a1644a413676b09faabee48fa2c7fe4cf97c5d529b7d48e2e12965 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cors-semantic-release-sagitta-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7555f2b8b283d0f1b33880c0aec348d71a94b6f520787045d49a43d4ead12f36 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in convict-pulsar-odin-pegasus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c5e10a1e80dbe898a0eedbdd73f7c13bbd6e948693740434284cc0d8da36917 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in start-stop-terser-hermes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c51be2fc585f72ac5e1c652ece518c196302ce3e5048abec0a7233a0cdc0b4fb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in inquirer-tailwindcss-sqlite-sirius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e7d2c4df32fc567b689d9a1bbf8975994a17c7e260c5fa4dcff587b6680ef6e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in polaris-epimetheus-chariklo-apollo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3cbe848b613b149556fc1e2da071bd0f0b9920973ce442185806e397d958f406 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vortex-scripts-scripts-webdriver-mocha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0409451d1fd539154e63a0e4b69cf370ab76eec634798644da864bf87004163b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in slides-supervisor-apollo-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1595e06feea81377f062048d00a5c9f0a522ec6bd4fd8422ee3423902b77b5b0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ariel-build-octans-cors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67b0a98d3a3ba455a53d80b80682430befd058e5be89086e648c677c3fd72324 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in neptune-fornax-miranda-mongodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25e546f80e3630052ab9e9536f8ee2827f28cb7a9bfcdf8362f0330a310ed9b4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in convict-mocha-castor-proxima (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf50b62bf29b274dcb258f4cbd7260d8799e01d06ed3dd44267be145c4590df5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aldebaran-query-slidev-commitlint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5cfed5132e8d320f4fb2fb99af73bb8777c499543b18594cfcbf201b4625eda This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in subscription-ganymede-update-loglevel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc2cd828ec2afd2cbdaa184beaa0bf885beeda1644bc1297bc3d9432898288fd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in await-wezen-nconf-meteor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 971b1434499a9fbd6456451777a548f2b380dbfca4750fb5aa08b2389ffaf522 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in registry-pegasus-ganymede-spawn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65afe8cfd85ae35917f7bd628db75ee6071d0dbee2b3c66a8420d9dcea9117b5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in upgrade-release-it-delphinus-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9723dac1015b770186c13a25fd43bc6378a218746a96c2afb664e0faf6941f72 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in koa-kaus-sirius-draco (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5da38434c856097646612b2314c16d72307a75149247333f78b7090326adf12 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...