MAL-2025-187687 Malicious code in key-tree-cron-serialize-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ff78953ae8c70b79b3faaea4d21dacd0a7182c0942619a5916fe974dfedf448 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in error-signal-minify-zero-index (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9de97ad293aa756831d0293ba26e692cc4a59e7f7ba970803c8b51ec783cb420 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tethys-deimos-spinner-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db2db7a09169ef6abba60d563529126c03efaf2c24fd4d1fa1d37c005535a3f1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in remark-fornax-ora-ganymede (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c243912e669259606e8a9f8f960ecc02cdb7dec0dbf107c3290c61dfef328cfb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tau-import-file-bad-byte (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4109c4388178c46ba55b1c77f6875170c704f0586b730e075dec134b695d713d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in resolvers-chakra-ui-bootstrap-ursa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d79ea6a0ddcc32a8eefe901fe9fac78119e8f7ef1b653b5f8b55b441099df42 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aether-radiometric-sedna-phoebe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7134d489c8a851a58b9529605d85a949d662e70a8a5b193333fd2b342b9db97b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in supernova-miranda-ophiuchus-resonance (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eee783b24405094b625f3cc656fb7452e71114de055fbebd3c90db0063e74b2a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in link-sedna-paleomagnetism-npm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89f83ee1bfae66dc7210489390d14334111a3890b2209f274fdf0e50672ecaf4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in visualize-cache-web-float-slow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3f7f24dadcead52f45d3b13c1e58579d94e0015bb0a26dfefe06ac153a45caa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in isostasy-ganymede-archaeogenetics-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e72a040292a691c04c12c28505f0378f69205785bee641e65a94f8f7df242d1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in octans-yakutsk-dotenv-leda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d751656f2ac7efe86e47c25583f93d9ae1536daffdceaf849d3483681ba1dcc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in paleoclimatology-node-sass-asteroid-pulsar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44d11927628a582b335587691209c5d269ac29f4ecf3d85eb1612706326c4974 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mutation-exec-arcturus-gulp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 482caf12c32414f2e9b669998df2ea4c0f636c61aa2294ed275285eea1b96a5f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phoenix-nova-pulsar-rigel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81c49362126a570ffed0fa24233e65c750b17a8d224ca38dcda9ff340d682b39 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in stream-andromeda-proxima-loglevel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6323a9610d6fe6ebc8aa514639950069291844d5fbcbb62c5f04ff9cc125f5c9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in build-eleventy-deneb-gemini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e60f9254d7e112b0cafa3f70a3f75b052568cb6aba5c5b36c30ab0558c2b06b2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in daemon-function-throw-file-dog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5a73e261a4f17a185bcca6a3ab3abc503be436cc2631043966eea2b64c29a97 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in metalsmith-json-husky-dotenv-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 478b97c7a91f7c4306ed3e704e7d987f5ad1bfcf878a6b3f756ab08441f24198 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in integer-pipe-beta-orchestrate-simulate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e55447a68009d0b9b6fa757453f8b249946f97b92a5891a39a495e91cec4d3a0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...