MAL-2025-148767 Malicious code in transform-lyra-run-script-cosmiconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bbfac3d27d5e5585da3acb64aa34cfa3abf68b3bb6b10150c197fca788b64a0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143569 Malicious code in indus-mini-css-extract-plugin-mysql-jupiter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60a86d37654c305f1ca7d6d2332f990117367cfff2ea43380f8079134bdd6b73 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148391 Malicious code in supervisor-corvus-css-loader-spinner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e717c0a7c2be48cd214be01d42a303508b2d0dbdda6904c59955d4168e4f36a1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145831 Malicious code in ophiuchus-ophiuchus-hydra-yakutsk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47788e2971989ebfda1e3e06af9e81bcdc202bc958dd8727b5529b76fd1c5c95 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146266 Malicious code in pipe-prettier-stylelint-fomalhaut-telesto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67ac29fca3ac3709645dfc3f811b8445f16d912d8a52b86c2ff781007970a518 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142593 Malicious code in fork-link-galaxy-css-minimizer-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0734bb69f5bd5eb2cc01b53a18e846470e1f8216511dc303c4d66f96faa7c1c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147318 Malicious code in resolvers-bellatrix-jsonp-public (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85843142028b8d29b219b1af7c43c167dc226099b6803ab77b73bedbb4a5f9b5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142218 Malicious code in eslint-fomalhaut-lint-staged-meteor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb105ce95665918097d4d61401177afe8ca59a34d9f9753e8c40e94ae07b8d54 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149052 Malicious code in ursa-corvus-aether-quark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c78819ffa548622865ca6465342d6402a8002cd352fa308a1e580dbc5f296c24 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146354 Malicious code in polaris-mdx-pulsar-transport (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7febd9331b89bf99942d2c9455a80d4e037a082471dd9d9df611c1f8d1306179 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in canopus-ini-carpo-standard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cb5be968ca0d94f6e02b8d6c96a37621dce07de08d5bde7184663b619ec78cb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hermes-wolf-module-halley (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89cd9954d6971b2cf0e3cf66fc047cf6d7bc6a3f73395d9f8105e2ab4b9483fe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in winston-cache-stop-request (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e071bb2c1f6703bd47158b0614599e4b4b79ec46dff64657405fff609fcec1d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lint-staged-sirius-xo-juno (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e17f64d7f2c40a23b7372bb25ea8330f1abf134122c1dbca12aa0be572e7394 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in apollo-commitizen-koa-farout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b9be3e0b6abd33eb7a29bfccc6faa0d3513fe2ed7adcb7007ae82d65c971681 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146437 Malicious code in postgres-iota-testcafe-chakra-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1560b6c8b722d09568f71ef3cd851c6896f97b12a95429813738ac245e8488f3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in playwright-cors-bulma-mensa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fe1fa01ee2f04af77ce20ebd02184ddf94ed2d21d9d64f82efe3f412236a439 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in norma-antares-react-bootstrap-weywot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cba04a759870f861ae77433b3e92b040853659b2a6f06f8e8d118c3e476f9e8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bellatrix-graphql-lynx-nova (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76e47a09bf599119403a4a06e83d5c2c92012f21f17c5765ebbdfc8c4b82bf19 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cors-antares-kastra-blaze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80905b19348dfe1664b0090e7c37f23b84afb3cf803191684c8a5a86dc2daed1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...