MAL-2025-149258 Malicious code in vulcan-umbriel-jovian-radiant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07d06f26e3082cb1c1ae58325b21f22029f52104bff9713f2a6c644765e77df0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147295 Malicious code in request-hyperion-gridsome-unuk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7865deb1459e7037f7abb2849c9868bff4ee00079f4c78d1fe2341bb6e0fb540 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141347 Malicious code in csv-markdownlint-npm-grus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e73e26256761af7533779186f15b847cda32f6523b5e531c46bdd00586275461 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141899 Malicious code in electron-builder-cz-conventional-changelog-markdown-pdf-rigel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a391ad765701a0afcc4bd8a62b5e4756a8273e7459830e66eed6cdd93cd2226 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144425 Malicious code in link-solis-promise-elektra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89f3c59989ecc8eae4a83da38af7837d57dde9a10c501c636c5a57588afabd2a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in avior-semantic-release-prettier-cz-conventional-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad1bee846b0039c60e0e0057b6c29b031b648b21ebbe632243dafe96452cfc5b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140447 Malicious code in carpo-kinetic-capella-helios (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36738fd5391a2e0a3836541071bdde4fa6d1a86665a79160d7c8262aec63014d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140583 Malicious code in chai-ariel-leda-remark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e0c19fadb59ff1cfce3dcfefcb8cd39cdd8131cefd27b03e987380a8faaa1e8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146372 Malicious code in polaris-stop-build-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60a373d1a5eb1fb842a336b3d3996d1ff50d85dbdbcf45ce246eec4e06c9cda3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in unuk-sedna-cross-env-xanadu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f46ecc9ad12a0b9cd7f2d3eb400ba8eea4dd4bf8faeac232d404afb24f07801d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chalk-hydra-parcel-prompts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 489671468c3b3bbbaed96e23a570df1dd1327928a57ba7af09270775777d457d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in apollo-envconfig-jest-jest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 546ab6a959b803324db553cdd9de9cedab5e5868186484d81e3025537071f703 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in meissa-wasat-optimize-css-assets-webpack-plugin-iota (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df071dba98f764582ffc7959b36e91c0b59f2b7e8b79a9a8eb26b36655cde881 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cluster-upgrade-graphql-quantum (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c639cd0d7b8b69e23e078c6ddede7e447c6521c2b535b4b9f8efa3d1b50e6d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in got-quark-charon-prettier-plugin-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2791fdb726654cfab79699ec9ea9331cf5f86011d5e2d08bda7ac54d9a50486 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in playwright-cors-bulma-mensa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fe1fa01ee2f04af77ce20ebd02184ddf94ed2d21d9d64f82efe3f412236a439 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ceres-helmet-wezen-stream (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cf466b18144d7948c134657b443b0a30c97b236683cb3ce5a18e23c2157c857 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in terser-inquirer-cosmos-solis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfef7f7c8454e3b64c77d4dba42ea2eb707e9fa4bda5a8195869d917e667fbd9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in global-draco-virgo-bellatrix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac8da2ab4b62c8dd339ff475a68b7c495dc169c8043db895cf6966aa61fdbd81 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eleventy-epimetheus-rate-limiter-aether (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ad9c1494c426eb22260ef16a91168d268cb9fd31c3e614a913bf3df717b7dc7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...