MAL-2025-149535 Malicious code in winston-yaml-webdriver-mocha-repository (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f2aafd2c598a36174246ed2a93655569ec5e247c8ea65d7573cc259e57155be This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142632 Malicious code in fornax-loopback-google-selenium (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1453791ccec0e6d9af3bb03731b15537c00689db44a6584eef16befedb6d447c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139825 Malicious code in axios-despina-karma-duplex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8151d5ca59d464e012a81354c3926da139a00a0f8ecf51fe736ffc94d0ebf35a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146367 Malicious code in polaris-slides-izar-proxima (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5652752c5327649b710c0fddf98f02ea9ee6201f06dbb31d2799633b926d6fe7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146169 Malicious code in phoebe-pavo-grus-pegasus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00a2a606b8dcb49d586718615dca3a20876645f3d5a3d5f21e04dd421df311d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146353 Malicious code in polaris-markdown-titan-spica (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35619b085a70cdc1371d350992894e62fa81e502bb384ba06be4c705b98c6742 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in celeste-ophiuchus-norma-loglevel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df564ee22102eb66a10cb47c082bc4a59c44d5c2afa313ff9093ee101ff0ae14 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144838 Malicious code in meissa-wasat-optimize-css-assets-webpack-plugin-iota (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df071dba98f764582ffc7959b36e91c0b59f2b7e8b79a9a8eb26b36655cde881 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143172 Malicious code in halley-weywot-publish-umbra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b78aa72c8df1766dfac0e590a05dcd0d30073bb00b6efa2ef53a646d396a2225 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139246 Malicious code in aether-xenos-xenon-elektra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09c744d5eb04b0340e2461f09e10bcadd760e62c092ed3d0cca00dad88f572b8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in flare-commitizen-graphql-barnard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector edafc44dd5f36d5fa54bf30d998c963dac42355a9ca104a929a926e16a49d7a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in playwright-centaurus-mira-weywot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4e2dadd319fccceca4e88f8c24faec4850087a86b14258c7cf356a8093833cd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jasmine-promise-fornax-jekyll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e265c204aefd939183aeb71493ecbfc215e18a52367478fb514d3f2a43abd71 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in non-blocking-ursa-postgres-cygnus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4a3fdd105ee5de4d8319f3c1fc42c4e5a68d5c3842e883524063669fbdc8004 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in testcafe-kinetic-meteor-arcturus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 656c9560ccd17e180daf4aa2254dc60f3255420737a36176c05728b8fdec1786 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mutation-odin-barnard-altair (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 538fc2c10d714b98d71e783cad8637329ed0e85548f6f23de01791388951136c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fornax-selenium-postcss-loader-middleware (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b5c5ec2e9a493e1c1dfaca85430575b03a67d2f1baa1266b0db4763fba9eb3e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in less-loader-hercules-phoenix-miranda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2202e59bc8b6eb663179fec4b52bcb54fe06b2a33c3a4cf3344a08f559886c6a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sagitta-publish-less-figures (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e31faf24c46477d774d93db7d78b3c39311f6669c9cefc0ff371546695dd8b89 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xenon-grunt-elektra-procyon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 605c1515f7a09e51dec27180935b274edf6061e32b33b0ad83fe5b42f9ce9e75 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...