MAL-2025-140316 Malicious code in callback-semantic-ui-pulsar-telesto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 725df051562fd911016ab37e1224723c9378e825feb45c51b9138e9a5b05c7e4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in grus-concurrently-markdownlint-ceres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 967406994297f477ec4001272a2beec41ae29e16ba0f0c229bb246f1ce5bbd28 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in callisto-oauth-rimraf-kinetic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07b65ecf31bd469e11e4da7810c1f0f232b30db6958c9b2137eb22895f805e2b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in registry-fork-terser-webpack-plugin-rollup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e5f80d581068875ac320615ae15a242874ae033d46442d41454a22228f38a50 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ophiuchus-phenomic-alphard-lyra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58fa29011d4a3463e0941cacae1e2932e8633bdfa6a02fee6fceef04cf7cdca9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in janus-nightwatch-aquarius-json (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4271b28738e8c99a3598fe804e43d022d475a7857d6901558568c2c3c6fab9d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in development-warp-halley-sagitta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cbb3a25f9e7115cd8827ab56a1321c0f8f884a081a2f18d75c542301245404a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vulcan-commitlint-taurus-uninstall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d629907d31f3bf20f5b40c5e2a33a188fb1a96ef7721e2b92c263ec7667de22a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in morgan-xo-colors-hercules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04aa1bb6bb4a6714a7e0c2987b4e6a5f6a8c9676b6d0218f927793c8aa80f362 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in backend-barnard-galaxy-foundation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a59049d351727bffb49a3667c44626a812f06adf443b2fdef5596e01172355a6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in loopback-frontend-prettier-plugin-markdown-spectron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76ff5e2656ce3b451ff360f78a67acd91fc9c21a7247fe942f1717f1b59d72de This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in shelljs-ultra-venus-stop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9801de5bef0e92a080f705b4bb2e883cb39029e1d4442212140cd55decd2c408 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pyxis-terser-dactyl-rollup-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 881621ec4d7106ed416450651d6195f7979fb834bddef57c7ba0760f7650fed3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in karma-websockets-kastra-europa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95a2f825d9a99d499cfee3bdc98a762a5ce61eaad687a5bb11c1f762337ea5fa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in airbnb-capella-lint-pulsar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b80181a2fddf012d48e5ae7bde1413806b7a1f47e0c32b51dd8cd7c05f2c632 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in winston-javascript-fork-pino (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c31d8ef523f64895d99cdf3b37549e07b7ff03de07b73488c2b778f8569fd1ab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nconf-readable-wasat-ariel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0599b1f33fa576bdb70fc7a72e764dfc3766113e5847b1a2f0ceb2cd50c5d209 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fork-run-script-json-bootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a487508b75acecea952348bb04e9172b5b203a5e9a7c982696c74b83d7457b0d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pino-pretty-winston-json-acamar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7d7ced402c9f3523ed686f438c023726ebfd93a97fbcf9f8146d5a2d75988d5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in middleware-antares-bulma-sedna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f4a195dc12e34bcddfd2b5e36d9a5c748024e53f940af3a3b5ec6ee8f472a55 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...