MAL-2025-147470 Malicious code in rocket-jekyll-geckodriver-dactyl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0eff17e6464f5bf010d4aa3a2133dbabe60bb7c7b5006f4b30cb569b3ca323af This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145624 Malicious code in non-blocking-stream-achernar-webdriver-mocha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa3f0aa00a06877ee792afc87c3c806b77a813807ca4ca6abb7f87513a020c99 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in electron-reveal-md-gravity-puppeteer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23c378215038e150535e23dd20905375fa9904d58db75526757f188d9fcc94f3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ganymede-nebula-playwright-nodemon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e1f1c5a4a1c55419ec29857d1e30fa3543b82900639e451034c7637c80e6af7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vulcan-nestjs-nodemon-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bca58c5db7f633962cd43a5bc3ee223af16b073b273e82fa1008712c7fafb6b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in javascript-stop-solis-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 604e6dfd483497d82c03b53aa28709fb0bd1b3c4692e4a3b5af4259d9b7041b1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in thuban-run-script-callback-meteor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae8cab59643f284802fbb4cbd2c8e1b457e20dcfeb60ba0e2de324276c9adc97 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in koa-electron-reveal-md-pavo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a1bc2848e7e40366ae4424bcf5d0323c1a8284f8c81db4e7d58b36a05f3f2ca This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in development-taurus-slidev-deneb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 475374ffcdc3aaaee37f7841dea13ea7b237d1cc81ff7123f954064dc69be944 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in library-ganymede-axios-phoebe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2f571dda046abcbb1c1c42ee2c0d27e57c8f35d99e5bc05f426ef1ffdf76dd8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sync-jasmine-elara-mensa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd6deee8ec024ad4e13702ffdff93ae9474aa89e6a47074d5679c9740029bd3d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mui-uglify-js-ophiuchus-cluster (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab3763d689299b26c905a36ddfa3ea5740c798a3ebbf3ae26b8f4a1e4150c295 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in karma-kronos-protractor-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2613bf60636387829ca0905577e948da2806d337f061920b907c9fc948430379 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dorado-ignite-kronos-prettier-plugin-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66abf121dfd2cc9376e533592688a982b3b97fa45c1a65d3d4d3d85a8e1cac52 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chalk-kaus-eslint-helios (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4159c0dbbb89b303076efe400413c3f25ca847b455c5b90c4a461c76df3e9ff5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in blaze-winston-mensa-betelgeuse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a068526da78cc2ec0686982bab50fc7678a3c1c8dc90eeea95fc2298d549b202 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gacrux-css-minimizer-webpack-plugin-flare-flare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc8b4a91227e773e130eae13bfb68e4884b8fad2f307cf3ea714f2a8819940e2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148607 Malicious code in testcafe-unuk-weywot-lyra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 462eea52ecf8421c53bb7dc5ea4eb44ec9e279532735153b7c54f5e3e44e0bee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149541 Malicious code in wolf-castor-rimraf-phoenix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b53cb9c657508e7f2692c16d60d43936cc7507391d4e49684b451e4afcad2815 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144668 Malicious code in magellan-testcafe-jest-upgrade (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3276d8f4b2f01340c5b8606f4b0a0722893d000c715fa38528e4c621543d9f12 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...