MAL-2025-166554 Malicious code in syahlan-poke53 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f688caf23bc47b4f867687f6c84a29bcb73277bfeafd3c33c059bafaacc27eb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in celeste-astro-corvus-docusaurus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f58e3d277cff82825e0b421686cf2246c1d36a3d87e8248f7367a29975591f15 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in init-xenos-forever-grus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 037cbe531b734ea1d67a651682ecfb3115ec8a3abe390a6a187266e51cbf4a49 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in express-ini-soap-local (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49eae2ca0c7684bc542e8a3126f14f9e1a4ab907103a7c6013ca9cd73841ec41 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in json-algol-antares-mutation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d63c510d3d3960c943e308a47987df9ca39faffaf1ad6c29a13497998b1ae469 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sagitta-ganymede-ganymede-dactyl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d447104cb20fe484889833bdb323e58a26301280d6177b41a8ced53b1abb2b6f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gulp-quito-typeorm-husky (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67d835e8e0d74ec55eb6e9aabcd80148a390649445d256ee27fa0fe751eb1619 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in metalsmith-yakutsk-juno-dagda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe7d8857f1269646d020d61a230349856e619bec10f9307c2ab5843d8f509f17 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gravity-bellatrix-farout-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8840af6420f87daaf0dc5682a4ed0da2e4e51c0d3acc1380a1e56dd4d9ca2b76 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in inquirer-tailwindcss-sqlite-sirius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e7d2c4df32fc567b689d9a1bbf8975994a17c7e260c5fa4dcff587b6680ef6e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mongoose-jovian-prompts-bootes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector adfc21902cbbe288d44e67e91822e196ee14eb461970003305eba5225b5ceffc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in yildun-nova-leda-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f05ae0cdb022e3b71301a0323b96a75c7edd172085ff157e6da24b348969c13e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in canopus-scorpius-kastra-avior (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4440eb9a52bb23a9e5c49cc79350174d4ee6e6de0608e1b396273bd4996232f8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in public-supervisor-semantic-release-rate-limiter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ca5cb99f5d1988c28b92f7426f9594a34d30f68949c8950719d17e65f59c3ab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in miranda-css-minimizer-webpack-plugin-soap-ora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a78c804487392c81ec4c5b2f22f56c86ca956fd102a26974d8adf7ade602ba8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pulsar-pegasus-aurora-proxima (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 830dd1c9364fc3f1966153598abe3ec32aa54e255501d269bd4e06e5d34cae83 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in command-fomalhaut-neptune-jekyll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d78ae16521163a3ed5a492595d96c7e26cff5740ec79450c7dd359b6f060c4b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prompts-nashira-pulsar-jekyll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b34b2df3d4a4995a17928a35dfc555917a0dc66c1262a3ba9686778acca2a992 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in auth-delphinus-yildun-kronos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6ea65b73e43a4a6c156e8b48b018e43fdc35e2b28a53421881ee86e87fdcc47 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in callisto-global-kronos-remark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 684e56e46ef72bf385d82b2ca44a9ec22885037864e2c73ade1ce4b3baafa169 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...