MAL-2025-140038 Malicious code in blitz-cosmiconfig-google-pino-pretty (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cde950127da342b2375027506ab6050f96edbff872c390936286f2f3ee67fa03 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149752 Malicious code in xo-nova-thuban-eslint-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a99b7389696fc93347916f07e6163ef400c2702bbc43e8fcb450d678c3660936 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in husky-element-ui-rest-eris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e72e267c7ffdbac3e4225e8420bd262444e2671ef1ee693768e182ede4033de4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in acamar-centauri-izar-spica (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a65dcb67a04bce7b3e85b8d8f65260f06ca2912a4141e61cf48c2c0ad51ea95 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in markdown-pdf-nebula-ursa-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e869b886c6b587ad65d90412d52a84099eb19a953c7c45b7087ccc4d3723aef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nodejs-quasar-gridsome-npm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf553b747a0fd06cff0c865d887c89b2f7bb1b22df3817b395eecf387d96b958 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in event-duplex-node-config-public (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91782b6d72afe4d207bd69bcfab8387ad5e5b1f67818488fa1c67774655d9e1f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in firebase-cressida-commitlint-subscription (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46504f4252ff87ca260f5be757ce7ecaa3594bf829bd535705879fe64ba14f4b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in request-neptune-meissa-xo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 192ae7b04f04285ae982c76237dc726ae80e3d013cbd96c0fe8ac8e70d13447b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in yakutsk-config-mutation-ursa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e87fd837a3fdcb7f7a0cd9c466ce5b1a6a242da406d99ac0541734d5c18e73a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ursa-phoebe-kaus-cosmos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69783bfba45e98d6a435b4c9cb6d5b9550e9c0d504d05dfb30783ac4cd3f6787 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chariklo-private-phoebe-thuban (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf258b2fe854550f13fbc74482017621aaf80f8bd14c7920dddaaba3a1cf2e87 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in google-install-octans-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9accc5f5e19d47c4312625e1ff6983f2f0adf820dc39d16c93cb33a2382f13ea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in winston-server-cassini-blaze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a935b48f23055193d417855846e711c8fde219f4087d81c066ddacdb7f0d3e06 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in terser-webpack-plugin-non-blocking-gemini-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c690b3a4a77471e0179fcf51a1162f00ed5621bc5863c4189f2d879b998ad165 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in semantic-release-hugo-vulcan-xo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22669f1738276fcf0d0861f934453f7eac47379e02ba69f509ffde9eade5eed1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cz-conventional-changelog-markdown-metalsmith-commitizen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9482e36bbe4901e1af6bb14db59f11eac88fd2d639fb758299a6a41f7db6f35d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in process-mocha-loop-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6c79f04280d8b86e33821a1d858105a2658e0adcd0b02df7d2a5ff349d20e1b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in reveal-md-ganymede-chromedriver-dotenv-parse-variables (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05bf8e69492fcec22cba663947e29cb7dbc03cf4ad877ee0b9b0db4d8dac3f82 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in meissa-atlas-algol-sqlite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 620c20eac5d9bb72b6d93c31c759d1b41add6bdb1393d047ef5a293c34052a59 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...