MAL-2025-146320 Malicious code in polaris-alphard-sequelize-atlas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7988b1f08d0bc2a590a8e320ec2c4eeee3fd6b264506c79c02671ab18b9c5481 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147076 Malicious code in readable-astro-npm-prompts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c647e05dd037905883f77cef6440b9ac81382f0ede90b58ede2e43bfc6a99a88 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in webdriver-mocha-avior-phoebe-hapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b1cfeb8ea3ae34191cbf175bc8f201b2e1d384825e7b62013a4aac53caa67bd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rehype-lyra-iota-bulma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d14a65634f2c9482704751a1262d96626592d9ab3dcef6f375979e96c07ce110 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in transport-mensa-tool-yakutsk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b711e55d7e247b8426e9450555e8fd0d78164118f6e17df135b162418d22abe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in command-fomalhaut-neptune-jekyll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d78ae16521163a3ed5a492595d96c7e26cff5740ec79450c7dd359b6f060c4b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in auth0-event-winston-alphard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eca62e2d6414ed0efda22dc45da9e9f2d5b43e9efcbfa092dd84761726126c51 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in commitizen-zenobia-event-pegasus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9be99bb8e5ef3ca11055825b864a1c017ac103c80f70668e065b8bbb94a43ffc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hyperion-hermes-xerxes-yakutsk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb79ac3641111993364fd68a5541c4fc3e81faf66fb042b2aa4791d8a1db7eea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in yildun-changelog-slides-terser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94c1e032d0ea97654da29e16043fd146101a608beb21f7b3ac344026965acdfc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140223 Malicious code in bulma-package-karma-pegasus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1eed95e027be6b3d93e60a805a8b140da2fefc31d366385a1db9dce3da622d56 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145439 Malicious code in nightmare-janus-europa-polaris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 103b72686f6c75739969098184b39eab91f66b52806609e70c348daa79d310cb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145157 Malicious code in mongoose-jovian-prompts-bootes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector adfc21902cbbe288d44e67e91822e196ee14eb461970003305eba5225b5ceffc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in canopus-scorpius-kastra-avior (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4440eb9a52bb23a9e5c49cc79350174d4ee6e6de0608e1b396273bd4996232f8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cosmiconfig-release-it-betelgeuse-commitlint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd8df59cc076ff9c49da6ac43f3320f5cb7a81a307812ce3527b092acaf0a9fb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ultra-exec-event-miranda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 441716421f5d5b913842f86b85b33d31d07b792fe47e55353a179bfa02342063 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147719 Malicious code in scorpius-umbra-electron-builder-elektra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 862a2349ffda24c475fb6b50662ed3b2a243d7c9031ce530c284e46c5f71a68a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139569 Malicious code in arcturus-fork-cassini-jwt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5034f07878345120b3e58d57a392ead084af6eb7f29ec57084ae84861f00c8af This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139426 Malicious code in antares-nuxtjs-xanadu-hercules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f174f64eaf238a88acf650289df7e20113ffb2c14d336a40eefe4f53d6f3d4c0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145831 Malicious code in ophiuchus-ophiuchus-hydra-yakutsk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47788e2971989ebfda1e3e06af9e81bcdc202bc958dd8727b5529b76fd1c5c95 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...