MAL-2025-146441 Malicious code in postgres-neptune-start-run-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20e313b6f9d33429c95c9c1d346a82c5c092d01bd5405df768c5b3ce038bb232 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cluster-elara-eclipse-betelgeuse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 048347085c1a35d570cef25eada38c7e80fdabf3e21687fae65165bcf3933e45 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in neptune-stream-toml-postcss-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6ecdbed3d1f61979e80b7310790181fbfae8d2f3d11f3eea7493acce573c6e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sqlite-atlas-dynamo-passport (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14187cef271cc4426484306893a6fee37db7948f0787533e5623a7551d59d9dd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prompts-zenobia-promise-stream (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2597941e827037dc95c37d6ce60f562a41e408f869d847205cfe66fc276023d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in loglevel-rate-limiter-markdown-pdf-update (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3df9ea4b32d4c9b2d2ce285363f2b37f3939d71151d71bbfea24e5c4bfac821b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hexo-child-process-chromedriver-jupiter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56017395a22b1feb5980e8e21e1e425f64d73852559bbecd77fbdc7e97b99099 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in airbnb-antares-terser-webpack-plugin-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 621360111310bb1d7dcd6fc7f22631c95a9ca27f7eed5e0424872f4f863ea333 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in axios-canopus-yildun-socketio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9c75cc7e529e037a08e7f6d94af5233d867f429b98b4a180494c1a58efb9d67 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cors-comet-ceres-bellatrix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 396b5b1e8a9baee64e013f5565e71c80bf877fde47a43126a9ea1ccca9b051e8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in equinox-eclipse-stream-mira (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56bfd17f4628a21dc20c811e5ba66f4d7e12628ebb94eb74e9e60a272a8756a1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in convict-enceladus-docusaurus-style-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b32a8b621e280e6ae91766209b9334a5f2c7e13d65c8e87032acf79b65bdbbab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in colors-csrf-jsonp-dagda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2e8430dc5c129cdb2b246c95ed2efc76f44ac2df52fa48247c0b286701cc854 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in async-oberon-framework-ursa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5717df4094340a3b32dc4b99bc68bf22c3d181bc748aa862add6b2fd0f2165f0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in electron-altair-charon-pegasus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50f8987084f5e4f89273db6c3ac75d507dcd8e0ad08677026e9f464d11e4274d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dynamo-betelgeuse-chromedriver-buffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 785b2087930ad8e2ee5993e91cbb9bba94acf15a486098752d583811cb48e951 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in enceladus-cz-conventional-changelog-slides-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89c0b08346bf9c56d0ce926bc8bcbe0c8fba7e8a52964cc09a4318f02e8cf27c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eslint-transform-terser-oberon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbf293f06ba8e34141c8b54aa5f1d3b141f1df1fccaf11b464aadbdd0e4fa940 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mdx-process-eleventy-ceres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1aa0a62a0964cc170bacdb14d0ca2933b6ded18f5398907f0ca41ecd9326ca44 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kinetic-pino-pretty-centauri-neptune (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a32af7d0f49e379c176a6e6103f86e25cb05acecb7aad3d0e0bb45637def324e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...