MAL-2025-148181 Malicious code in spica-terser-configstore-taurus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18813c3e1ff9705d5e8cc26b5c1dbbcfc10f8bda51eec707edc856eeba57da51 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143218 Malicious code in heka-scorpius-module-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40cfe8bdca0d340d1f0b472bc30366a76ea92e2065b9d2174337175dadb2f42f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145866 Malicious code in optimize-css-assets-webpack-plugin-markdown-octans-blaze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4fbe1c2b2cde5513e863fa8fc192ed8bd1e1098a5964c8016c02142c5a7d565 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140008 Malicious code in betelgeuse-spica-figures-hapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3acdf5fc9f9d033c6c7d517e33b6ad029d2ed749734530d1b07dd7e485c2871 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145371 Malicious code in neptune-passport-venus-zenobia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8b79af312699923fb557ac1f93a7acb0b38786ee080279ce5cb81d33f1d1e97 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142325 Malicious code in event-spica-gridsome-semantic-release (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6f0c6290eac850e1d6c4cb0fc81023c3fbee17e9f5b5395d1c16f9dc4ec4e83 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147884 Malicious code in sequelize-version-build-thuban (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bba6079591827284cd67207a074de45cba5c746afc4d3cb6faac41206fdddfe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142586 Malicious code in fork-duplex-request-triton (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e738a11e30835b56b26b4fc6d11d4de4707343ac26462423c3509933099f59d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144501 Malicious code in local-wezen-dotenv-safe-ultra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 281fe684a136130d7565ab0e4602a9cd866bf34cc9f1ea4a1be03ea6ae16ccd4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141894 Malicious code in electron-bellatrix-foundation-tailwindcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1ef845444cb41e42b4cec717cd866a04c8cd25e7b5c993699ac5f03bb16fbf3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145511 Malicious code in node-config-jasmine-sass-loader-mocha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71be3c59e0dfe748e4027f1079b928a11014eb9ed0dd0db124e3b57c425b16d8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142370 Malicious code in express-cassini-warp-soap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddd22234b7a86537f1ae17969398bec86c8f6bda4b4fed0732595138012dbb89 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141700 Malicious code in dotenv-antares-eslint-plugin-sedna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db8a5b6972240c48c0b37ed1252dc6990aa4763cca8a5cd7f23c5ae0bd9c56ca This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fornax-aquarius-prompts-nconf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6206ff487ec40eb65e8f7173869d22aa14bac87e0735273ccf10c371304274ea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fusion-indus-atlas-iota (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe29767c5b6d5ab886cefe4d1c91bde80862347523e6d222ef5f2302785b50af This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dependencies-eclipse-websockets-yonder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6e5431a759d39a0e0c0617d7467bc86541b6958fb8d0453e08ae6eccc56a3be This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tool-jabbah-inquirer-materialize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96c23f115a9c2230624fa6f80276eacf194a28e0e56c5b3d3a789f1e944714c6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in private-install-radiant-version (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e53c3db67dc50d23af922b8b66d3017fe1f3bb7845987f6c590cf7c7b42b827 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in arcturus-chakra-ui-css-loader-gemini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e569838e764acfb421a87734a9bce1aadf35ce79e570ec2f763d256404265852 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in perseus-spectron-webdriver-nconf-electron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f0fe45a7b9ee67b12ce68386241af989b4f9c8e068b0353797bc22300d63894 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...