MAL-2025-155176 Malicious code in fitrok-poke11 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3d11aacc1aadf0776163310ad9b66e2c67c241b338393a7f0c04a7cdbe83072 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ganymede-lyra-arcturus-firebase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 116f0653ba576b64db957b8616b378786fdbf0a14b176d898cbbe3bc05bb2e0a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in got-quark-charon-prettier-plugin-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2791fdb726654cfab79699ec9ea9331cf5f86011d5e2d08bda7ac54d9a50486 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in configstore-graphql-pm2-virgo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0df4450f2fb42c74059bdf2515b13d9ec227be42735da764c21f0c090c58f9c0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in command-fomalhaut-neptune-jekyll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d78ae16521163a3ed5a492595d96c7e26cff5740ec79450c7dd359b6f060c4b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in buffer-oberon-dotenv-parse-variables-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 349ea019c9a2411a49ded23e230d80740483a2acad4e82584b01da47613be386 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phoenix-lint-global-andromeda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b343b3c7c23c80fbb1559d9e971d309967cfca013ab9173753f6cbf65fe92735 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in reveal-md-karma-rocket-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0526c1876e6ca917c406bd85bd5f010372f899172a5af0441719f3554760a9dc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in unuk-sedna-cross-env-xanadu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f46ecc9ad12a0b9cd7f2d3eb400ba8eea4dd4bf8faeac232d404afb24f07801d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in celeste-astro-corvus-docusaurus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f58e3d277cff82825e0b421686cf2246c1d36a3d87e8248f7367a29975591f15 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gravity-bellatrix-farout-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8840af6420f87daaf0dc5682a4ed0da2e4e51c0d3acc1380a1e56dd4d9ca2b76 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xenon-umbriel-jest-eclipse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4789f13d13bfc6480462c74df2249fea0b3264ce877ca27a1707785b3777eac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in elektra-comet-kaus-request (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f19e35c748b77d4b457b3cb6602edbd409762762c7000fa53eba59cea78c3b0f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in redis-magellan-hexo-equinox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11d306ee87ba5effd1c09c4499374cc41c683e9287de16007dbd8653665a3c89 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in winston-cache-stop-request (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e071bb2c1f6703bd47158b0614599e4b4b79ec46dff64657405fff609fcec1d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hermes-wolf-module-halley (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89cd9954d6971b2cf0e3cf66fc047cf6d7bc6a3f73395d9f8105e2ab4b9483fe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hyperion-hermes-xerxes-yakutsk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb79ac3641111993364fd68a5541c4fc3e81faf66fb042b2aa4791d8a1db7eea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in json-algol-antares-mutation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d63c510d3d3960c943e308a47987df9ca39faffaf1ad6c29a13497998b1ae469 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eleventy-epimetheus-rate-limiter-aether (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ad9c1494c426eb22260ef16a91168d268cb9fd31c3e614a913bf3df717b7dc7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in elara-aurora-yaml-ophiuchus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b510c3be7a7298f8e915c26ac8fb7d1fe488f01e6a722f87091f00c11084ea3e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...