MAL-2025-144875 Malicious code in metalsmith-dione-phoebe-ignite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b7fa0a724ed7a8a460cc993e6fe4b7139d1c9efafe18cecdbdc2df864e2c1a0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139254 Malicious code in airbnb-gacrux-concurrently-betelgeuse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f902fe71cb86fc56849ea755fcc2c4cb1b0f2d2b8b5e2ba0e79f9a3113e4a17c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145241 Malicious code in mysql-comet-alphard-halley (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a005d0955df6e4e93cf6262bb033d9c63b11a8dc4ea15c3d2b0c59d7f6791f0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139628 Malicious code in async-json-metalsmith-elektra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d3de2ede2b17ab92f94ebfb9bc3a04946b83f63dcaaa1578e8dfc673d1438ca This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142040 Malicious code in enceladus-ursa-bootes-rate-limiter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3245fc3adbd9e9852df9a8e88db35cd0e9d70c380fd57dcb2a3c0dc2e340d6a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141869 Malicious code in elara-centauri-ini-draco (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82f1ab2a055433d5ee1d938079bf058d314bb9f51c2e41c1167b8fe11d06fdc1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143578 Malicious code in indus-standard-semantic-release-prompts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0857932897470d06bcae252529029eb6859e79da626add35f7ce5eb8a6e154da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in yonder-venus-buffer-hermes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51d3401fcbb13614cb43cc714a5d514e36caa6fe0cc27b35299a6f00a89cc8b8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in elektra-comet-kaus-request (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f19e35c748b77d4b457b3cb6602edbd409762762c7000fa53eba59cea78c3b0f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in umbra-sirius-scorpius-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7721c0109181d5cc7814e23c29a571aeedbdfbfc5a0cbed0d273bfe7ad968f8c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in auth-delphinus-yildun-kronos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6ea65b73e43a4a6c156e8b48b018e43fdc35e2b28a53421881ee86e87fdcc47 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in algol-forever-regulus-miranda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4211f798c9f412b0916abfe461be011e99a9edb91f9ee5b1abcd2094556917da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in convict-mocha-castor-proxima (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf50b62bf29b274dcb258f4cbd7260d8799e01d06ed3dd44267be145c4590df5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sagitta-ganymede-ganymede-dactyl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d447104cb20fe484889833bdb323e58a26301280d6177b41a8ced53b1abb2b6f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in install-betelgeuse-zenith-nodemon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a08b8d9f256af66e0829d46984add840408b56494c471b1c80839bea17a9bd3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rollup-bellatrix-telesto-jasmine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 570a20400e7cb04c854f91844d4ac87547c947929f34a5fe71b52210e83d2789 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in resolvers-kastra-hydra-eclipse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff37cd335a423752dd8b1bfcf8707b83cc0ff0e4471cb874fb88f228d745ad08 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nconf-hercules-prettier-stylelint-slides (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4de94077beec0f658f2376273e3937aaf74f02106107d2330e2ef39e87bfff2f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in javascript-umbriel-kronos-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e00f1ebe329c4b4ab18fc494517cb4ec5ee2e7059ff770fd9aa2d251d5b5c0cd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in csv-neptune-fetch-meteor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb24c5d3b535a0b5cce2ce3b89a0d36c4c30e0fdd5322f5b0ca38d84d577bbdd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...