MAL-2025-166733 Malicious code in teaa-reborn36 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6a81bf00ed6327a5c966b64f36d6a64b8f3c0587ccb57708c1faeb216e66056 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-156994 Malicious code in jeep-poke27 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0132c86d497cbc778562d2e21308b3336331b06da6d442af69277516e42d11ac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-163202 Malicious code in nokire-nana48 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9101f2aaae051bd5820defdc1edc584203aabb46b449c4b164fffce7162d2552 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dajouka-tsfdaa-ta14 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a7616941589122a1dd5ef798cfe408fe76e5d6cda257524522f53ad59fc6964 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in @miptaa02/vibas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 736808fa2783dd91190069564969787ccf688246f619e54b08e637283af7b0d9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in verify-aya-aul (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47b04a85e4e1d88d16f0cb54594b39854a0cc1780616e7d2ee8ffa37e99b25ab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in manttu-nuyati-miop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62f335b0144bf4709a0c6e6e120d73ec946673d0101ba52610dcc0f9ccc4539f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in icha-68 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc32ce2aefd00701c1761bbc44b2a1716339c7b8b869da9f977c0d7000c10ff0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aji-6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d37ac08e129c9b44df8a3de1b2cd340dada43158334be6c56f67f3c3b6c8d94 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xanadu-miranda-fetch-aurora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cef337b74baee56faf0b2022c88234dbf3f417113cf143aa873275ff626573d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in changelog-optimize-css-assets-webpack-plugin-leda-passport (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a5f4f0a1427e61d0122916e6836552a05180e8e2081f271cac87516f12674bf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in release-it-toml-transport-carpo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f398e45e8b0671ccf4006cd3c34befd3a76727ed59619a175ee0f0d23d33fb84 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in alphard-pino-quasar-eslint-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f746fb29e19796cc7ae57f5ab42bf57a701711ce4a6cdb0c6da4c876f9a77627 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in centauri-enceladus-playwright-comet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e588972d11e7d8059b4eebdb64157f16aa516a734c8c719a0f4ce586331e6ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hydra-pavo-taurus-betelgeuse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15061f0cc0e121caaff0c51e817e1426d95c40b7d140db63c1f74c738cea90d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in schema-websockets-loglevel-readable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b88a4b65dbf37e6fdf0adfcd0161512614e0b1263de412f1f00033811b25e34e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prettier-plugin-markdown-sails-process-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14cec4c47bf880dbc0312f699945952724a754541d14cd4729e60f73900dc187 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in envconfig-ini-zephyr-iota (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 605fe81490d64b2c1a772699d84c2999f71b970b02bba2e93361a77189f5dcfd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in morgan-backend-bootes-selenium (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2d478dcde22ec2327defb9b0c58a5a62631639752144f7df308808fb78553b7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in markdown-polaris-vega-sass-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae813a6e84ccdb08cd5cb8ebe0295281892305e93d57e4c85684c0d77a016911 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...