MAL-2025-140349 Malicious code in callisto-readable-europa-pegasus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9db60a5246fcddf3c7698341dda6b5fef26f7659978b69669b34dd4547503b1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148511 Malicious code in terser-centauri-celeste-bulma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e339383723734c046325b9da29001c1e0448f40a44486961005b3795aa6de17f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in virgo-zenith-restart-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07fe21562e735a0fe98f27a49b5b6b1b0381e2bf1d80496151aac69fb232dfc9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in stream-dotenv-parse-variables-izar-antares (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cb3705933d0afb8257fbbb769f307552c28fc1caec37d0f89bcfa8b30e937eb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in adonis-polaris-umbriel-wolf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06219bbded3881721c3e959ced64cfc307b212d788ccb4e83daffbd8a6be1524 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in helmet-cordelia-enceladus-terser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4b8bd418da80c790ee8e7a2408a7e231eb7d041e340392fe401e6336a6b6c02 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146625 Malicious code in procyon-wezen-html-webpack-plugin-wezen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67b5af772803ada032750ec3f8403347e7a424e0ea7df55a1c9aadd26abc0e2a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in algol-upgrade-ini-acamar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac480b2708c408bd3e270ab7728873ee2cac76bfff620699b9d1e38965fe6cfd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in electron-orbit-eris-sagitta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31d6232b592be2cc1a0994076a160047d12756e8ff87bd53613432dc6ecf7e06 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sedna-publish-nightmare-terser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 109fe4cb7581fed558952ccd1f82ee28c7e3109b5eebb03cdece4d8b05e7b42a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in carpo-elara-non-blocking-upgrade (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b9625c431cce9029212fb9accd6de2599b0e5c9279e513c0e674e8544d0549f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in perseus-colors-schema-enceladus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8bee6fcebd73680a62ed9f99126853217c03c9c567b7e59687a3212e50d45158 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in galaxy-centauri-iota-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a152542847fd6e29764406706789bc7deed6adcdaafe04f284d237d422af5695 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in express-docusaurus-phoebe-foundation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96b55d736c3d78cf07755776e2b8f0e5716fd4c87b87b2e6bf232c95af61c788 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in shelljs-csv-antares-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57e0289f23944cbef7e11f6498fa51536ecbbbd7d2ea016eb28509e35c602277 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in electron-hugo-link-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78f100f8b5a13d11ccdf9de9d337b8202eda41ec541af1a521b3ae2e6fe73503 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in webdriver-manager-webdriverio-build-tethys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a769157d32d7855f2e263fa2a168e8f0f4b9fe1cd1c23bd76f0fc64dddc57abf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in async-europa-exec-solis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dcb5b17666335f424f3b57f121a395c4a988c839904a66bf1b8ba23e5816471 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in telesto-release-it-google-javascript (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6ccdd5032ea5072b6c78227164fcfdd6caeffefe98b43a5d8156d92454dd74e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in convict-sagitta-capella-remark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 243af60bcaefd4a2f191e0403851b712f8cbab97e1be2ea0df86e12c71b9d373 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...