MAL-2025-139410 Malicious code in antares-got-nashira-janus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e05586c6b012e053902b0ba00d414e28fcd3163d35425086543ce4e5d9ed481 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140461 Malicious code in cassini-cors-concurrently-nuxtjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8121f3bcabf23a54ce9586482341eebe56d5f0699a7d633ecd0839dbf98e468e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139295 Malicious code in algol-forever-regulus-miranda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4211f798c9f412b0916abfe461be011e99a9edb91f9ee5b1abcd2094556917da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149051 Malicious code in ursa-convict-nestjs-lynx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a17ac3f9b4f05e842acba5c8e967663a637c3aca6d0c4644af434e627c4a855e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144801 Malicious code in meissa-css-minimizer-webpack-plugin-kinetic-apex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd3e37d1cf32921aa706fc4ffd97c8fe9ad694e5c8c7a37d55e39241b81f6b39 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140792 Malicious code in cli-dactyl-restart-meteor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93e4eca5980d748e273b5ae71572bacf25be9a4a96d84712a0984c38431372d2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jovian-version-wolf-jest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4f69a9086862655d20f6380f2c35b0ee7d3c426cdfdbd882de75490dd08a20d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xanadu-auth0-xo-kinetic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2b26664e016b9ce769434fbfbbce3b3a7ed799f42d2c8b2848fda3fa7fc2cbd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in configstore-callback-redis-gemini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc902eedfefad70cb1e53bff07d347343986663b7e4cf05ee0bedb6d0f578343 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in apex-frontend-jasmine-bellatrix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffd8b8ccab7799216be46b4cf2e947e5092a34b8055fdaf5a7de01224ce7b9dd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spectron-webdriver-gulp-quasar-janus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8ec1782fd94cd2a052595c443f107e56f998bdf4ed021084cc0ac67e769f89b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in electron-altair-charon-pegasus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50f8987084f5e4f89273db6c3ac75d507dcd8e0ad08677026e9f464d11e4274d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in local-wezen-dotenv-safe-ultra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 281fe684a136130d7565ab0e4602a9cd866bf34cc9f1ea4a1be03ea6ae16ccd4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in axios-canopus-yildun-socketio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9c75cc7e529e037a08e7f6d94af5233d867f429b98b4a180494c1a58efb9d67 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in release-it-mini-css-extract-plugin-prettier-plugin-markdown-commitlint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eef36d47d6ae8f741f94ac19f984fd1f6347dbc887b13c2ce02e86997baa8cc2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in webdriver-manager-bootstrap-rollup-plugin-callisto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec7bbe5e837b28f9e4274f2918f25ddbe0c195af41f7991b59ecc91728eff530 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prompts-wasat-charon-cosmiconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8812a5f00b2abfe082d0356b8481321b48341d4051a93e24483b59a2c6ad66cc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in airbnb-antares-terser-webpack-plugin-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 621360111310bb1d7dcd6fc7f22631c95a9ca27f7eed5e0424872f4f863ea333 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in request-magellan-nashira-jsonp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb038937d8f4ebb3e7b9922687f8503ee4277c16c3b7389a6dd6a4e4770f21c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cors-comet-ceres-bellatrix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 396b5b1e8a9baee64e013f5565e71c80bf877fde47a43126a9ea1ccca9b051e8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...