MAL-2025-145414 Malicious code in nextjs-dynamo-gemini-version (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6762dff6c35a79769f64aff5cba24b6d655d7829549908382bff12256f004d89 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140332 Malicious code in callisto-fornax-yakutsk-nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92d4146fe49f7b6256b420a78fcb513ed920fd481edd057f15304dfa337fa61c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141256 Malicious code in cross-env-gemini-oauth-weywot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a4106c023551a8a784aca23591a676915bef17fdc0b2784ff7bbf6e37865ec7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146156 Malicious code in phoebe-link-changelog-rollup-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fed773ad62f38e8f3bd74b0c9bcaf7640090adafd10937effed4cce88d7a9c8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148748 Malicious code in tool-passport-sqlite-triton (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5532993780f2898962fe1e2cde7c26611b691c63cdfb4725106159dde5a99bf8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sass-loader-native-jsonp-callisto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 721529421aaeef8accb9c675072bf8c91146dda70fecc5f4ea3d58ee3727c41b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in algol-node-config-soap-odin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bab280bff732998bb8bfe8b8157bc57c923098a5f4503da372fb8508a4b66a0c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in colors-registry-bootes-redis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e96ab8b439374483af0e747643273de16e3edd479811c0743f9b3bba63150c07 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nextjs-xml-yaml-fork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0671b2be9d6650ff8c43e98f38d0c53b0646276240a6657802b68ebbc5153381 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in playwright-wasat-sagitta-xenon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6025a9c4a34d28d5fef4bf33d34d36f5441114184959e734cd7837e43332f066 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in node-sass-iota-hapi-bulma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91dbc27182aee5bfd31b5146e3edf1d1a806c781e33de5ed7183df2ea72cdd82 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in equinox-centauri-lacerta-callisto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0af7e42dd6ecc2d5e444e441dbe9d246c94856bc0fdf210e3b3ba99c7d462551 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xml-mocha-restart-semantic-release (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8889937709b9de60151a64d3a34b8ffad489e0390ae41d61c3eca5c969ff729d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in package-bunyan-uninstall-gridsome (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 927e4554a71f66a6a4f439906cade05f79691db231a52561db5eb5d1eff4627d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in metalsmith-ultra-ceres-fomalhaut (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 776689ae45d74b271ed19b9bff9e67824bd653c6eb8a6ffe860fe7b8fa4dbc11 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in europa-enif-frontend-mutation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5d1cbb11bd1538059fd754625642c6b3a833aad1d0337b86d54315327f193a1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sync-rigel-prettier-stylelint-concurrently (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36fdfe2ba2f55f9166a1ca14e1f32bf78fab47697ed4a1450f221028760010b5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in readable-astro-npm-prompts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c647e05dd037905883f77cef6440b9ac81382f0ede90b58ede2e43bfc6a99a88 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in html-webpack-plugin-kastra-yakutsk-hyperion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 554962f3c3fe3892239c0e730620019a93ed3dbb11a98ee75ba8ea467ab3a632 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in repository-transport-delphinus-solis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd0fdc46c42635553bfca3774fe744b2f18d608d3c3168032ef8cc6d1e097991 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...