MAL-2025-142389 Malicious code in express-odin-hermes-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f4a12a2e3d29015fd60bb1b74335050cd8247b08bd4de7445715a897fe6709a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145582 Malicious code in nodemon-less-gravity-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 405ba04f7fdaecd140dfc69f1313e561ea136c3ba12352ca7657e3bf0897080b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149645 Malicious code in xenon-grunt-elektra-procyon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 605c1515f7a09e51dec27180935b274edf6061e32b33b0ad83fe5b42f9ce9e75 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146591 Malicious code in procyon-envconfig-readable-meissa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6697fea7d29b65951aa52d6a9e51701f0dd3f5832e77e69d3997f6e525d28ed5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146487 Malicious code in prettier-plugin-markdown-mira-rollup-plugin-slides (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c59df9e16b1d88777561b0576f22280225530cc5984f4353928fdfe3d86100d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145000 Malicious code in mira-altair-markdownlint-electron-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a3a9a1d2217dc28fa56bf41ba8f7d16d0b014d78bf3de28b24e6c5a8d48a0cf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139701 Malicious code in aurora-luna-ophiuchus-auriga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7529c8b52158312b60e08e1fc053d2008b88292b60a340f064f9c5321f2c53c3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149044 Malicious code in ursa-bootes-fornax-norma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af6e382da872237546ac26a0a389df759f947829b129c8d324ad31240b58c7a7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142432 Malicious code in fetch-await-epimetheus-pegasus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d55f3198a2540c23b7469e15f06bd95fec082c5ff6af5c5fa7386896da555ad8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in delphinus-jwt-vega-style-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d56a0489e227f87a51124ec28f0433242c31269ba85105ff53e90fe143e98125 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in postgres-neptune-bootes-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfe1f7cc57e5378ad22e5eddec6f8f07092ecffa0c918b156ad32967ae2ea0d1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in frontend-phoenix-hermes-wasat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f13dae0a6b9099cf69f24f905c54a9e0d5e3b7825909735087f068e4787d854d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in stop-package-phenomic-cz-conventional-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dc099d38b27f19ea7c371913a1c7be9ca31b14fcc5d5c992ed20417fdc8eea1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in docusaurus-pulsar-update-aldebaran (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c511d5a2ee8f9a523e4d749bd04e47f8df8f083c1a69cb00ce364a7c709c6a31 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in koa-process-gatsby-stream (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 798a18987a0275abf563f2f66f0c42262f0a090747f34fcd6f0305174adf9131 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in helmet-cache-galaxy-alphard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6add171345211d071a5d346b6853f2ba78d089ff05584c0fe992c0bdc87d2b10 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gemini-hexo-blaze-slidev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f30924ede32759051eb6b9deb8e2d14160f20e4e8c7c21da25c9b90eaff26e7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in figures-orbit-uglify-js-uglify-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f60f9aa94c69a7c37a8439ad9a6720c7eafedc05f15f696808ea15458f28ecb3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in yaml-avior-scorpius-mutation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector efb86a3851bd639ddaa9794a64622b643d6b6404755edf45bba75dfa40dc0017 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kinetic-betelgeuse-relay-toml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdcb555e3d60d4afc142c75c5e27a22f2263818400a0c623dba7c4630cdbf9a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...