MAL-2025-144342 Malicious code in less-optimize-css-assets-webpack-plugin-miranda-algol (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0aaa871e18d8615f0e0c18e15bf0a02a74ef0928a0fc68986a09fc66ad5202a4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pegasus-helios-bootstrap-meissa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 443c660eeccc84458663b73683dd4f9945a478b35f6e205b836a99b218487f68 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zephyr-arcturus-venus-markdown-pdf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0306ba2a66a562040ba161f4fb6e25dc06409989cbf83a434b364aad0c900f57 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rate-limiter-ariel-slides-reveal-md (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79ebce7dd4a32781d94b11798bea39890801057ff66aa44dfcd434474655649d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gridsome-grunt-lynx-readable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb1ba9d3e7d79a9d0026ece280516128249ccf96c91cdb61c89adc5bf8d80487 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in run-script-bulma-jupiter-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 616dbb1bd56cb2d5f22936162eb14cfa2d9fd391f8e8f257f39b6f3cf913ec59 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ursa-commitlint-transform-mongoose (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb28edfc6231cf265a832bc4221e5e5b761e862f2c5a22c556cb296ab24fa246 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jsonp-html-webpack-plugin-epimetheus-spica (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad6b48ce6c4a45cb2fcc599034b019f71452bdb46a97116784b1fd1d4b5b2e1c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bootes-install-impulse-phenomic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00721d1e761c857e566783cfc81bcc0e6ad51ebe3a2394924a68755be13da065 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in barnard-prettier-stylelint-testcafe-warp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4618205a87f80f36fc1c5ffab89c4a7f8851cef1fd278fc5faaa3a56cd859d8b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eleventy-zenobia-repository-middleware (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ae2136e5bdbd05221b678c962214e1a8d32d1041f90059c0e5d329e1d48d0c8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in typeorm-odin-server-aldebaran (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c42515628ebe4f29f49b338b463fbf9cacf11f0c276fc1094d4db107c4c92279 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in subscription-ganymede-npm-terser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9742ba035e5f1e98720ecb8c1cce8f1a725321198efab9176dd131d69a77f181 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mongoose-colors-private-metalsmith (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2016b08d398ea500476ae7f3915149632d7a439309de048e028ac5181209428f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prettier-plugin-markdown-indus-wasat-leda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f05a1808f8706ac243238666ec94a2d41548943a8cb519f9bf6475a331efbbd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in init-hugo-markdownlint-hydra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9b9c9c533b3e13f12e53eacc434f17f1733e0a4fa8bff7628a7329b9850c9fa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in convict-cypress-lacerta-postcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9760f23e4293d7c57730048e52da340abf6c34e4763dd063f1121ace07245cd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in superagent-transform-betelgeuse-chakra-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07d46b2f7461a6ecf7dce969605db3f238a1d45d20793b2f02e16c0bf2f66c94 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in babel-bellatrix-lint-staged-json (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0378d6a689f39e6883f8a3e2443165245902c2be008f4f94d7e9c198dc7973c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nodejs-cygnus-sync-markdown-pdf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83ce14a4ddd7e7d11d764543dc23faf3d5934fb6001941a7c607b55b5975b389 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...