MAL-2025-146671 Malicious code in prompts-nashira-pulsar-jekyll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b34b2df3d4a4995a17928a35dfc555917a0dc66c1262a3ba9686778acca2a992 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jwt-pm2-sirius-dione (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ecfb2565bc45db26c95bc5b56093e599e6063f6d689c623a3d25d40a4f29dbd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-safe-postgres-perseus-draco (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 118c548fba36106c65ab5a4047e37654324785d2a7b091b8c04a743d9c47bc8d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in local-css-loader-ursa-venus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d53f49874e4864e74dfa98d9d5a9d4aab907c412463f74c6247ac80cd5a0c0a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140630 Malicious code in chakra-ui-transform-callisto-unuk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d6aff6f665f5d65e9160b95c96f0f11f50c7be5f51cc556bf3a6bb92a1f1324 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148184 Malicious code in spinner-adonis-jest-callisto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ce7a252c8fb466cb202f8d2441a363fa351a5ccf8b69a0cfdd48a0238bb6d5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in firebase-cordelia-ignite-cosmiconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 191f77137175533bdac0d7f62ee240d294f070f0fe423479516c0edf01b5fcde This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in umbra-nodejs-nestjs-node-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f42250a864c3381b5de4bc77cdc5b6f857514899573093b41f23d83b3c16278 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ceres-hydra-rocket-stop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80e19fe3509407b837afe1cba9748d532e71518ada637a85b02b82a2f65b2abf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in release-it-phoenix-node-sass-dependencies (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 252b6058a3bc8d31180d451e6fdd6db27a4b8de5be62ce3bf854ce7cb5599181 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142419 Malicious code in farout-neptune-dione-transform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c0c1d2d632485105b695892cfdf331ec228fa9c0c4b44667c6207987bd0b91f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in atlas-update-npm-enceladus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56f2d7aef349a4a4c1af0129621a1377412eaf9def5c2bce23e8995997ba60ac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142646 Malicious code in fornax-promise-less-heka (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc474568ab6ea1c4a33328711e82d6c2c1af6eefa3436ba7ab3702f46c427ebb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143390 Malicious code in hugo-loglevel-fomalhaut-optimize-css-assets-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 581e61a3fb294771917013ca8905c2e2d9088aebd76a3cae499452e2fbfbd70a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in global-fornax-supervisor-react-bootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0acf146c879312a52c4a11dfd8019469b166ba992f23e25b1a184a8024ba6b9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mutation-electron-ariel-nextjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 135b0d2df12e34290fead33825c7864872688cb11c7ae9ae435f360558c43e1e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in antares-ignite-apollo-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9955c0bdc50f51dbe4056f786cce9f2a0b67b0957ae6479ff9241960d1faba6e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140360 Malicious code in canopus-ini-carpo-standard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cb5be968ca0d94f6e02b8d6c96a37621dce07de08d5bde7184663b619ec78cb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144432 Malicious code in lint-aquarius-morgan-ora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 602a9e575ea97787e2315b95517cc650d51f2f0bf594adf1ade583b2e9857258 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139898 Malicious code in backend-wasat-ceres-fusion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78977fc84c2e7c36ed3f9a84b4d2226faeeb53aeda92309a9ebf36bcdb7a06ee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...