MAL-2025-146649 Malicious code in promise-rollup-miranda-nodemon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e81746e72d8a1587e17b3860845b2296f7c314699720c015d7dcf8b67504630 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148990 Malicious code in update-await-uninstall-testcafe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71c2279fe5109fedbf05ed0de8e7a13f3135c71fca750b79602f5366b373ebbb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145655 Malicious code in nova-configstore-envconfig-winston (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4ce7ba149dfab81053af19e5fda3cd4e6ef2373a58b40e024f4b6e06cd32a76 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146800 Malicious code in publish-phenomic-phenomic-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a89ad163831682a4f9c393633188ef89b0371d75e58767e815d7e03d8bec4ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139860 Malicious code in babel-heka-virgo-despina (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 840c87e2ba9ce27cff91ef872cf38e9c82b5182d865525076fe53fc0b1207117 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in buffer-transport-dotenv-thuban (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4d83035ce63668bd4eb199426469192d2492c2d5e513bc731b0d837d9e29673 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in avior-leda-cordelia-middleware (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8ebc3dafe421376c8a68b4f99a070c82d6b07785161a4d708ff483c04935e82 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in webdriver-manager-chromedriver-fusion-achernar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cea532cf50fb845dc6bfc7bd4d8d1fb78a1e79e90fb526d9c58d9205399e22df This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in install-build-readable-gacrux (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f03e847818678280e92c3c6e82daa26f0b7e22d0fe3afb9b4d2a96f20cb04908 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in io-eslint-plugin-yonder-unuk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55f1228c8a0e8e5f1e992545733045dd7f98234974ca9ca788f347f162434515 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pyxis-pavo-electron-builder-odin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1894ca2a1a514aac9ef1d57aed50f718cae881ce54de97f55d9eb99529b4d86a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dependencies-equinox-despina-eclipse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39c683b2a7d937899f8905e90cc2f46225ee2a5764154d6b399d88a67ce7d677 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in superagent-hydra-algol-request (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56c996b6ede00885261ac17e95a57478bc731d36b5ac17d25dfb729c5d90785b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141508 Malicious code in deimos-webdriver-manager-public-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dc1847b052c14b0eca3479e9583bc1ade4230f8c35df49331801119ea3a3f16 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142858 Malicious code in geckodriver-centaurus-nextjs-figures (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ba9b9f0ec80de37a48f007e55dfa74069ce00fcac7ef4f211b533318ac76a0d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xenos-run-script-weywot-exec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44b1e32708e609247ff12298f129e107d30ebeafe72b630f4eb6775ce62f1a8b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in testcafe-webdriver-manager-pm2-radiant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f846e3d65d5e5703d9a9fb9b98b8be41399db85e6feb68da6523eaea3c0cccf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in apex-yildun-iota-schema (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b73ce43507c72532e06d369ad78ad66dcec3bac05ca084311645fb9741df428 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in json-figures-gatsby-standard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00f0f17392b56d80f72cd5d178af7fead25d375c34ebf71364de580a8bc05822 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in uglify-js-restart-delphinus-hugo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ba0449c1680c050d72fdaf4e88e5538f499c761c28dea380cbf83fdd0af6d86 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...