MAL-2025-140664 Malicious code in changelog-concurrently-subscription-middleware (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f83b2e12272a8e785079ce5d459cca1a904c1e9310d88115531e97fbf868592c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140703 Malicious code in chariklo-mini-css-extract-plugin-rollup-google (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4885d904321f1e54289c15c6b9924e8d678610816b44065f535762c4433516f7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in express-winston-yakutsk-halley (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe636acbc97a299d869084bd0513317bc3bda86908730e32ac2ac31c50b13256 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146511 Malicious code in prettier-stylelint-mysql-ultra-winston (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 346b072f90d39311114a92c9e9cd77f1a7d23ef5852c232fa6265d3263e30e4e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eslint-config-apollo-uglify-js-metalsmith (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a4aba2baee216127b0c025e606eb26aeea734c1225a518563943331c359874f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144095 Malicious code in karma-build-sass-loader-kastra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a0a1706c5747b57ad2a3fafbe469c5561cf6c547799ef10865bda8f35e773b9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in repository-oberon-private-sirius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23f3f2cb0806cf61edd320aa4c7424aed2cec173f00e9f069a575bdce405dad0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in changelog-taurus-registry-dactyl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53159aea5ce380db3b88eb4598bc7c2b20a6594b39b1036b1ee6c316805d286f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gacrux-phoebe-graphql-dagda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f68c04258710a2b6f395d4cf50b5517baaf63d917dbd72a928d9bf32e8bb1ba This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in firebase-eleventy-protractor-vortex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0798504104232bd981669802bf8d352aef1ac84de841bfc470416a94c4a6512 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in got-jasmine-zenobia-cz-conventional-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9dadbc22d6c22338cc6fc5058d13df1e0f881a222c8c88cce245321bf4480aac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pegasus-terser-mongoose-koa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e082163d5827b000c5b136c6eb51be24e66954f12fd324992aae6f786120cf5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in csrf-process-janus-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ffbfe931a8e51ce2cf27b87751a2a29dae84389abf262cde9b1af1587c6307b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in markdownlint-algol-chai-terser-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11cac21b59d57f39403b3152a77369e8dc1a301daf2eac4c4931b9a68807b037 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sass-loader-mui-library-optimize-css-assets-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66e74a0f0b1190b28e62b75438426908b78b6776a7293dc127d4f7f037d74279 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in andromeda-module-xanthus-arcturus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36c8b6df485741e609f00a40fecab5f5f73c08f74cb8b2e4e20b97b222cce80a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eclipse-alphard-promise-commitizen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c2d18ca2f3faec8f5b44d1646ac4e157f8fd63aa204750ef48ed219fceef1d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in elara-google-auth0-galaxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15389f5580c9c15a58a0408109441fdba6487427ec7c99e16aa04252529901d3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nightwatch-achernar-cordelia-sirius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 105fc85e072ece9fd5861361f709213a2b73b7a1f06aecff21a9576fc64a26ef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fornax-dotenv-safe-delphinus-kronos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 642878f7ea02757310af6a4a32229ef548b1d47085028952b7c4f950221c7adb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...