MAL-2025-139812 Malicious code in await-venus-oauth-deneb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12768900fb6531d21a6c7d38c5d1cdbfe8e4317e241ff500685713b38f7aafe2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140388 Malicious code in capella-got-norma-postcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 378a90563bb59c066009d1f716b8397f7a9794d238c740fa8209ae523f935e56 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in iota-fetch-cressida-kronos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49c4f0e250d0f01e37aa7792b1b4a8643a196c2c813a8e3e6686f406cf1d3ccb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in radiant-vuetify-pulsar-xml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd5c4b7e2c2de1ea070292038e89f90d1b8687fb1eb1ead236ee6a082436ce7e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in enceladus-stream-chai-loglevel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a963320fc9701dd9f33123eca2220399517e38a891994d0bbc0ab226aabcf31 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in umbra-metalsmith-hermes-perseus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector efbd93e95ea1a4a643c5056c08bcede32284315366dcdf316f1b9da9df3b55c6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in carpo-bunyan-server-electron-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba6973f52a63181e3e68ed68ba75c24c59287e638797dd3fe7f6afe8254cc2bd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in taurus-castor-concurrently-nextjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6fe561439df87bdc121339b0b1da0ea314d89fbf61cc470407caebb67f86795 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ignite-babel-juno-wezen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6efdead4ed42f6f74b60a3017dd381e0f65833d1f1c15b4575aafa8193a99305 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prettier-ini-babel-mdx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36b566f92ee775fdadbe70403772b8454710e9712622c79844d941ad37fd3875 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nodemon-nestjs-juno-procyon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9f7590f0ff3753b613157316d13bfbe14edecb65e1df69e658f416e56c691cc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in apex-charon-bellatrix-npm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d45efaa2137362f3875d3d485c2cbe47b7af8b35490c7f6d3da3eecf4e1be69 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in webdriverio-meissa-zephyr-convict (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 184ecdeaa3917c9291a5b535a0b3fc11bc061913eb43b8f6a9163e3a070e4faf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in grus-magellan-typeorm-jest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f18449376b83609646a9b250f76f59430fe7e04389cbc080054e433d67a80a32 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in meteor-sedna-markdownlint-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b24b23272bb9a9b6fe57ada512032b74918ee0417d5834f858230c532e1bc667 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140088 Malicious code in bootes-postgres-module-ursa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87297a5860fcee5829f7e212c41486ad5a4a23f21ca3ba580b5af5d2b4bc41ae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144278 Malicious code in leda-koa-dotenv-safe-atlas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 808c73d9e9f389030423bb79948118805a5bdf318cf7822ce009acc6fb93fa32 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145825 Malicious code in ophiuchus-kinetic-development-ursa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7cead306982c4e53b259b7fe60ba0baf7a14b6ea52db778371e3b45751817ef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140928 Malicious code in commitizen-csv-impulse-wasat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce9b3fc630c93a6b5abcd841a0ea99789e5e3c89feb5c01aa57716144c2665c8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in buffer-oberon-dotenv-parse-variables-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 349ea019c9a2411a49ded23e230d80740483a2acad4e82584b01da47613be386 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...