MAL-2025-142696 Malicious code in framework-wolf-yaml-electron-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5171dda2e66d0c63bc03ea95d0b716b25ed5c71b006bc563842e12f1b9b6ae5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141005 Malicious code in concurrently-firebase-remark-postcss-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc2bd0fdd87661ce67e74c146f4b7b9cc662fd907f84c6906e86d075e198c677 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144462 Malicious code in lint-staged-mutation-orbit-triton (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3c9aeaa19579be18420287582995f1bdcc81002b80c09f383588846803e280a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147632 Malicious code in sagitta-yakutsk-celeste-procyon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90591d766829f3a790ea4d9c1652e0505ea1c2f38420ac201bf0912f328d2cf2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145855 Malicious code in ophiuchus-zenobia-passport-lyra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0eca8c97cb6ac0779080fceb9527f7442614f57c2e63e5ddc7208cc5d617a013 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145495 Malicious code in nightwatch-vega-pm2-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9721711530d3774701e2dbb09bc46c5e32016b8e64cfb20ad8261d43bf4fa1e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in umbriel-chai-celeste-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb53ad9f8260d9f1a374259b5f212dbf32617f7afc84f7ce85b009b16a3e5db2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-cosmos-promise-css-minimizer-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57077612de819acf7cf711556c614e951a7d5f2f92fc0d3c785812dc62b803b3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in telesto-aquarius-apex-restart (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93c69141f3d539b7b8b758d6cba8108ee1a7af3ebe626b704d04a5561d5f7f18 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eslint-plugin-element-ui-hyperion-dagda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5038fe2a3c36f89c8648d1958ea6266b9e56a0ef60f2efb00d26435c3e79a2b9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pipe-testcafe-oauth-uninstall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac49830a775e6e52064295a2c04405b45053b0115212a36f284f54de5fc706ff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hermes-concurrently-hermes-subscription (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e0fc504fe20b5d7a624bf4f16d4f30312aae20867a0ab2bca5a06e6e80bd777 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prettier-stylelint-oauth-dagda-venus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a71ca9cf122bb124c897b6679bb61b645e6812b59362397a8c70fe9fb150c97 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in helmet-dactyl-flare-uglify-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57bd1c045b58ad64b757331e6f73aabe93eb2e88d53c053b83f4c13383b3f05b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in iota-docusaurus-mdx-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector beec391661dae987beab474a5c6896851afb310bcc2fb8753cf7ff547dbdc624 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-safe-npm-json-chromedriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 940f316bfe7f76b339bf77bd6623e5b20440bc8d2590a90996d4892bcd221a97 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in style-loader-sass-loader-public-hermes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e805d44407ac18708622f0b1838f3bec9642b086a4cfc54149f103ab2b9a4c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chariklo-spectron-corvus-scorpius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4d78c278ecff4ebaff38abca456c02346ef98a651fbad21ad8f688104cf4822 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in json-centaurus-yakutsk-comet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf37872579d57c7904980d46accf7a399584cfd1c2f943c8c74688895d68442d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in capella-axios-build-ophiuchus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6de1782855692574879b52f874525f81e799648d8226dcd053e2552dc17fcfb6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...