MAL-2025-141272 Malicious code in cross-env-semantic-ui-dependencies-europa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6332d430064a3f2838ee485b692085966c87a656a847987e105921afff07be4d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146317 Malicious code in pm2-yakutsk-config-puppeteer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c2e5255e395d97c0c19ad124a7bb7e09a8bac51d104ca36b700752cb833313b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141173 Malicious code in cosmiconfig-await-cressida-inquirer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bd2568a507aef1951ff5eedd43bdd5b0ec74acef3c09457d804ff29fed8d97e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149743 Malicious code in xo-async-less-dorado (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abd699bec9ea713703814b65c3d925c90e38c7b5078f81289df60659781069fb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in inc-tomato-hoverfly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 286c81453c169eb334dd954a990db761b5fe48b124e4132b65092030af1cf1f3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-117068

Malicious code in spotty-green-mouse npm...

Malicious code in historical-coffee-quelea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b6593f025cf4fe4473f5fe807674daf7dc74ddcd5183077aec7803f195a005b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138581 Malicious code in adequate-purple-lynx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df65d9ed90c6b0e40b3541d480b9b1ba126f97ee1c1a5ff0683824c7d064fa45 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in grateful-aquamarine-dog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5352403d2c82ea93e9612c7592d466b84ba466cd6f4bc1dadbc563994fead63 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138903 Malicious code in nutty-emerald-bison (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c0fa4900235fb6f238809419cd02afa43297d01c65ffd16ba7c6e7afe2b43ac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in agus-sambel59-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c8e04e72621409c47f47333be2e974ad991682c58463982d574a90dfa154f34 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bella-lodeh89-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef335d0cd7ee7e4c18d79d10ec472237931757dd7f095f741cdfcc1ae7531b89 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cindy-empal78-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9af9167f91bb57f553515755d2d3728ab64698e2c2bc99243460573b6f3db0fd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dewi-empal61-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b99a540a5251c5cf2e8869482475aaa6cdade39e3550c6f49b3fc4e1926c971 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eka-sambel68-sumpek (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1e954bc7412f2419a141d79b1a4acdafa204b48f29c4f3c73f366c6b2ff93b8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in erick-teh87-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d8d2222707bb442f0676fb17579da4d89c41b880dac42f16cacf4a2c2128558 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in erwin-brengkes65-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca8c8c65aac2f9a56855aeacc1acd6bd83a9dcb889fea160014c409b1d7d3314 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fajar-teh57-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bde93bdc45c54011ffb907865de1f7884db47cafef2c50480f3638035697d98 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in galih-serabi17-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f99d4194dd999e012460c726753d8804458528ba266c06592eb41cd35b9b1d1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gilang-nasi39-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 198298b0f571253974b78139b23e20ba5e1dac443bf9ab3b325d59ceeec0915e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...