MAL-2025-140081 Malicious code in bootes-install-impulse-phenomic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00721d1e761c857e566783cfc81bcc0e6ad51ebe3a2394924a68755be13da065 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in query-toml-mongodb-alphard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac5ccaa2ebfe16419da2c790aab04492f0b9cc5ca3df72aeabe287589dfcf607 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tool-command-geckodriver-atlas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3d4c1dfd04a531ec9f0f8abdf611775cc1f6fb6b997f973bad24c056990bfcf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in yakutsk-kastra-webpack-release-it (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da31a94dea166f9732544d8bc74d15fb23b8b8d49f3dcd8465de86a7b8ba7022 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147810 Malicious code in selenium-registry-capella-mira (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09ab3f71e7297e293a72649daae86808b298edb1456fd5e8450176bf422af724 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pegasus-eslint-plugin-postcss-iota (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0531401803a4a5dc24d00495ddce8dbcfa848942851ec09e9616e99dce22824c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149096 Malicious code in vega-pino-async-xenon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6d0f26680e56ace586af2cb62e80c1e93b2a6b1b0f4fb564bc901d72d68adfd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149251 Malicious code in vulcan-rate-limiter-library-tailwindcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92ca4da3b6360d40d6112678563f6472dad484026ac05cde729730f1baf9471a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145865 Malicious code in optimize-css-assets-webpack-plugin-magellan-grus-unuk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53aa5e7c9dc3d753d65b3a92dae95e45ef42619f35d4b3c87f3f5db8bc96069e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147064 Malicious code in react-bootstrap-loopback-acamar-csrf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e2204866b46af08416e01189305d8a67fe4cf159732b41f5e52e84a51b67bfa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146907 Malicious code in quantum-loopback-element-ui-wasat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0063ea8e4d2bc6a050c399537e5a25d2bc5e8d15ce2b5352dc33293858aa0952 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139265 Malicious code in airbnb-unuk-cosmos-eridanus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce898b52c94e42ee07b7975ef14215d4954b631a47a0c5637fa525a9742b1800 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-safe-gemini-spica-materialize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d90a21326b456e45374854954b0fa67cbaa4f70120bb594b30d8ad762c87e9a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in callisto-koa-passport-init (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0618017da8555c11693d63a92fb08bd79ee8b5a12fa2199727a8fbca59b2c45 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cluster-dynamo-morgan-radiant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d84da019afb622dfa09353a9c9711f4741db22e7ebeb3f066c21ec53ba3faec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in equinox-playwright-xenos-solis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cc5f310b893a67c3d52cbcbf20c0fbf6d4ba00816213bf8a73618b3556d2d43 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in postgres-zenith-gatsby-reveal-md (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f848a04c62462ebd013014e94dcd21fad1daa9a9bf0195d04d8e99c9c335dde0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sadr-jest-await-elektra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f8f94094428f0a2150123a27e6aaa31f5343d172db32867c1deedd1ffd7de9f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in antares-vega-electron-achernar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 040d240576965aed13ed11371c55ee7e2365e2d115a89b45043d3337d7d15156 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in procyon-wezen-html-webpack-plugin-wezen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67b5af772803ada032750ec3f8403347e7a424e0ea7df55a1c9aadd26abc0e2a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...