Malicious code in @osmura/treeify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4643c1f27e4916ea6090f1e6196c980fa1d65b96899a80b1f57633eaf16a61a9 The package republishes the upstream treeify library Luke Plaster, repo notatestuser/treeify verbatim under the unrelated @osmura scope, preserving t...

Malicious code in gemini-csv-gacrux-andromeda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ced967c56de8ff045642f561fbf86c24467688d2df7cb1d27846905ac9dcfd3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sequelize-slidev-forever-rollup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7d1f9d87e5296caf1b7c624845186eef2f3d3f442b9fd68d4216c088d7c779a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in firebase-command-ursa-websockets (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acd3d6a206ba901560c4623937d141df01d36bf233f95ebff438b1128f0840d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in global-schema-unuk-gemini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aef95ff16cdf95db51f17b07305ed739636baecdca77c9ac45f76f5a27c7d581 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cressida-vortex-lint-staged-blueshift (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d541b72f12f4ff134a895458ff7ace3372090c5a8033ba0c1df81b2f95297a48 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in emulate-earth-lambda-iota-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6ef28b45310e660baece35a53cab9f8cd79a0a7d8211394c43df03cc593fdd1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in taurus-heliophysics-commitlint-config-angular-superposition (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3142a8b96d0c8015bd6d17f6e9038ce57ea590fb830bea588d1c9105ba3e48ea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in node-sass-nuxtjs-octans-eris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15489028a7c893c81b5652d7e2f95d596441e527e1ae371106f50eccccd6388e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mui-xerxes-proxima-cassini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1c12bceab74b6419a10feede58b31581319ad3c2259073f79ffd2d6f2445171 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in deserialize-double-simulate-interpret-tau (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1114da922ec6e540f842f3f0bce3a0caef3f8610fdc2dec232c5995fa3a49ceb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in runtime-stack-awk-visualize-monitor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29f5a4b7134730bc0468b4baf98a46892732f059846e6f73260ec464ed7e041f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in draco-gacrux-carpo-await (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e99af30e309e14cdab037f48e58b659c2e89b47c57ea0ca10d2d97b6c7f47586 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in equinox-sedna-sequelize-convict (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49d21c1e2f37e5e821a84eed480f80f27b364ea4e2b3e2b5cc5e1d16499a649a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in babel-singularity-got-hadron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a774faf06bed4991c85dbf810dd99be5b33abf9179b3e4990f8badb3738a1cd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in callisto-enif-cryonics-dotenv-parse-variables (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f1cb08800e2395ac2ce2014130ec27002e68fd1d04853aac2157234a70f9542 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eclipse-parsec-native-commitlint-config-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ad95dcc42d1e37b32db227d88bcbb1c29f48527e882181591d17621d99b3b24 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aether-quantum-computing-koa-xanadu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84a4b8cd8cbf9f137039d3f9b8aca496bf6d4154493af8261c7c0610245ed308 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189918 Malicious code in thread-compile-parse-decrypt-air (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a7146ef933c1aa178443b1e6366208057596a2447d96deb31dc0f893f501187 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185590 Malicious code in astrobiology-flare-repository-cluster (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 883c270e21889ed0f7b356d9f7ecda33006111d85778289be3c2634ca143571f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...