MAL-2025-164172 Malicious code in pilka-lniu-kanuka (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57dd5dd30f2f91c409496481abce17a0c64aaefc118d6a2c84315c3fc58db411 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-164129 Malicious code in pilka-kalima-nulivauba (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72c832059aed0b70011f989ae212bf5317b18f55dfd591faf4a399ec4103e219 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-152544 Malicious code in alvito-poke24 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8243cedf8a085e0b878b00ee53c3409c717faaa93c35cbcc10a0790284235875 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-167302 Malicious code in teagood-nakamala38 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56086196f1164b5aaf370b2f9384d6c34cd6b69e3fd1e835b9df8570e1eaeace This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-151358 Malicious code in abina-amoavugoi-anunhi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 402c6f652a57d55f04f2ceba119e4065cccdeefebad7164329842196d6edd8f5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-165877 Malicious code in shilang-poke57 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3121b1030817a9e12920e28a9a40644d0f9174d0e62c5bf58c8dc878240c69d4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-169343 Malicious code in turisna-gsd-11as (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a38b8b9570cc96f5315fd5b8ba0ebdde608fece7f2ee7df0b54b5f595fde71c0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spinner-nuxtjs-dotenv-parse-variables-chromedriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 072a55a8cd70a5c9fd73bd2adee50e90c1391fc076290e349f99a5f1fb100a24 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phoebe-link-changelog-rollup-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fed773ad62f38e8f3bd74b0c9bcaf7640090adafd10937effed4cce88d7a9c8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lynx-dotenv-safe-nodejs-json (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6919ad399f328ce955067abf86547693652653aed9b5c770929d62db585751ef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in event-sails-public-phoenix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6d555647d04d651bab45eb39b53f266c9fb4e89c2b9419b02a13f17aa58859d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in antares-meissa-protractor-lint-staged (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 127e8af1e544db79827073a7711bb9875e3bb675484e3de81581b98ccc332d7c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in markdownlint-start-materialize-ceres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5b86e7289af41e3713ee478fd25844f6004df8c4ad8c5ecdc276dcd607a7588 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gravity-bellatrix-farout-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8840af6420f87daaf0dc5682a4ed0da2e4e51c0d3acc1380a1e56dd4d9ca2b76 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hugo-cosmiconfig-hugo-canopus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c4f594b558f1dd74bf1202360e9678c1faf4b03a2f37786fa8241c6674b6b88 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chakra-ui-command-passport-kastra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78aa8bda85f98b1e6f2ce18f280186996e1d6e9bf6b3e726f5bb83c5fa67937d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dione-leda-meissa-non-blocking (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cdd7424b138fa68f71572d8066f481860e9136ef3c9711080a68be656b53719 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in elara-betelgeuse-frontend-gemini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44f3dca50663543b5cf7dc24fae502a6de9e183de1a7d880d65ffdbced035af0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in epimetheus-nashira-node-config-forever (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3680ee4ede4d45b354c8e3ae081df1daf439b7b39c5de63cbecbe66cb1ec1eb9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jwt-ganymede-meissa-playwright (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa0c01666a92cdf3398dba5ae53b375ce14478ed631928b37880ba1eea55e208 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...