Malicious code in @osmura/treeify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4643c1f27e4916ea6090f1e6196c980fa1d65b96899a80b1f57633eaf16a61a9 The package republishes the upstream treeify library Luke Plaster, repo notatestuser/treeify verbatim under the unrelated @osmura scope, preserving t...

MAL-2025-187799 Malicious code in link-uglify-js-fermiparadox-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b06dca166a8b4d24c9ce17bffd59e25dd73bad52a682aa28c3d281a6d192b7b8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186959 Malicious code in fetch-readable-spectron-convict (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c63589f0ebd1c39360f807094399bb7293af123a3f30940dd806d287be6c8076 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189288 Malicious code in route-proxy-alpha-export-monitor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82ed7ce7a196ba7ed5bc586cfdd287f1bcf2abf295da782560005753652fe5b2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sequelize-configstore-neuromorphic-petrology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 331304d79cff69f391c6eb143a6a46aba4a0352b74829991bb35559f8e1d6e55 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nuxtjs-quasarjet-cross-env-taurus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector facc075dd9444f2723af86599f1c0a112a283b2d101a025f16374e4e5a91ff5f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in enif-terser-webpack-plugin-sass-loader-spectron-webdriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a30834a5fbe857adb14874de5f845460556c9a36ba75d7c2eee5f917aa980bd1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bad-alert-long-container-mu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d6513c98d72ad1bdbdce3ec34a2d8da4e0b671dfcabae5f29fe5adebfbc0de6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in publish-prettier-stylelint-seismology-cors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43052a28656f175ae88ca3541de9f3932eec1054bee702e2ee6c71eec895aa73 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spectron-commitizen-server-jwt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f5520a0221162a9daff8f9fc7fd1859cb9e5017d1fa3d3de33024e017fc173a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in superposition-quasar-iota-mysql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbdfc8778c8d71e0b855f75cb949b20b7db9ea2d330350f1e624393f65ef02ea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in parsec-wormhole-futurology-ablation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf1911b3c66def5ee6658e51820a9cae8886c4bb0ea48807cd601a9cdb960637 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in javascript-magnetar-epimetheus-figures (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd836a25d5aa73f526777d2c602b2a919e137b30c1167b63e65262a3eece2544 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in polaris-interferometry-sails-convict (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7c5081fdf4d0f7619a6a230546bbed5fa605459a20f2fa63ad703371acc7140 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phenomic-loopback-rigel-mechatronics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd2c60808f9819379866cda6ffe21efd73b974a445126a3dbefeaf8be4e60424 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in slidev-scorpius-dotenv-aldebaran (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35a54165db7da361334553c966eb5152e75555cd344fc44c637a633e938c7a11 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in secure-compress-phi-bash-orchestrate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4452d7b0255f5bfde9306684c29b815108b9f682b2d753820f2f60cabf2806da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in toml-json-express-event (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e3cbd03b3937d2d33a6253b82a0a39f4f6f81fd66eebf439e0d0ec0bf26ce60 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in miranda-exec-meissa-terser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6aa4ae84ddda5465733272a077d844865623f79611a78353acab0d23bf825bb7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in node-sass-slides-koa-hexo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3d901b770938de6417077db7f0e64048574068406c7bf11efcce84fe61d1993 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...