MAL-2025-189632 Malicious code in spy-sun-byte-debug-import (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94dcc9df0438390b12a282f8619d7e4c2c062b0442a82501ef29e1bbdbb48902 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189841 Malicious code in technosignature-wezen-blitz-blazar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e17bd367392dca319922695da590cbe880e13845c7f4e45ae2229ab21915f867 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189234 Malicious code in rho-water-load-info-mu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e14f7985d79c2471901d930216ad13686fed9538a20e6f305ed6922c2116b68a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in middleware-antares-bootstrap-fork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8413a05fb60698d2bc5a2570951f668c8b724e92016b863ae04b7b1ee7906617 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dynamo-ganymede-init-sequelize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e715e8c5f4eeb44cf07f8c9b46a4f6969b8a88191d479a03ab364e0fb432d76 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in boolean-balance-delta-visualize-resolve (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4486f7f8f007d39807ec34e7aafaa6a72b864684faedcf051d0fbbb27fd69878 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tree-awk-notify-beta-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c40a4475634ccb865c954dd93557022a7dd70e0549691c1cc71b59d788988cb4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in exosphere-troposphere-grus-cluster (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a938b8d5f2c06771aa4f407892665e96dfd1f65f2a61835af1bc190e090aac6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eslint-plugin-weywot-bootes-cypress (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cd1c916db1f971a732417678b685bfbb98d4333956f25b6febdee70d72eb371 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vuetify-thermochronology-csv-cryovolcano (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 203350dac17303b45c43bb6a8b176ec28f297d373b7b00d634187149616e7c80 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eigenstate-gravitationalwave-config-ora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1ac45b72547ad9810a75d1263cb7b9a765a2eb4ffc477983e5b99f4890b2e1e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in local-lyra-cli-rimraf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3d2ccdb241affe9f7c727dc834b0d859c9f62002f7ded63cd52e753247ab990 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nebula-gulp-bootes-kastra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afb6b5c7c5ee58afca59f9703c1eb66b71298f71dace2f66ef3181095fc0f2b2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in postcss-loader-regulus-whitedwarf-paleoanthropology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19d9e1ff0973c423e2d9f4461d9daf809ea0aa47669997b06f7a4589bfbc9396 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ursa-inflation-atlas-taphonomy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f08f459b286f25ce6361ca667b880bc5e7084907c298b11aead0995d00ae6e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in telesto-publish-oberon-charon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de6837a499af3bd764db78016d59ed3b3b1fe3f57a03f81847910a466b622002 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ceres-redis-umbra-terser-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c562522cf6b72f448c78de70d7ff9552bde4eb19fa9ebfb50cab599b1bf80c9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in norma-sagitta-bellatrix-postgres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b1a517b27fdb18f2f93c4d6ccbb461ffbef3fc61fe0214cd6f5e371ec604139 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nconf-wavefunction-titan-europa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f580c1365e3107d6828ea1c51ca9f2599601a5abd5641a83d71d1a55e6659a7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in version-virtualreality-scorpius-wezen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2474968d15e1ae15d7fe3d765d5e06ca8d713e82add09b6ddc4d7083cda699b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...