MAL-2025-144127 Malicious code in kastra-pino-equinox-iota (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eda6bdcbe3cbb6ef8ab1bfa09ae585d6cc0e53b722c68e483091d717214b52b4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147339 Malicious code in rest-andromeda-ora-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8a92c88fabf7123e7ffb64c069cfb3f6a546e509857b2531c764b7e04bf9748 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144993 Malicious code in mini-css-extract-plugin-release-it-antares-rollup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f560e4dc28499f01e23a21ff3a7f9f9933e46e15c9ed192660af888fe635613c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142159 Malicious code in eridanus-wezen-module-unuk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db08aa8da6ac73487e2363d886d20ce680b382956c29cd219ffbbe067a61d4d4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142074 Malicious code in envconfig-halley-despina-barnard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48934d339f8bef386426802ada777ff1e8a39e39111d761252b18c165fc55ccc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149882 Malicious code in zephyr-charon-draco-antd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74ed338c2debeeda0e1406d49dd402a5cca90b1cca0aa88d2480ec73c64a6d2b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143602 Malicious code in ini-query-bellatrix-quark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17868109012618c362d16e0753aafcde22ed72095743ee03fc5cd4f777ae66cc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139796 Malicious code in await-dactyl-flare-halley (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0997e94e577b4a4ff7fc6f45c2326910b7e2834f4394205bbbd2358585a5f584 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in iota-json-release-it-chai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector edc6039f43772804867eff0feb0b3fb834d4017115e87fd7edea16f77618515f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sirius-repository-yaml-oberon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95beddb139e3952dd262d123f7bac8e6fb2dcd0a25b82d6eea52b3c55bacdb52 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in forever-tailwindcss-orbit-element-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4085287e53cee21a1b2871fc6302e58161bc1d180e0510e2232091f732f96c23 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cz-conventional-changelog-nashira-blitz-terser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b28e21e9bf524cbb8a38981d8287833ea31e36be5c9bc62a97d998ddfb499a5f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144608 Malicious code in lyra-grus-csv-dotenv-parse-variables (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e23074145049a720e304aacae238b9e6e91e6e85a207ebbd06a7a074a4f7fa95 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142681 Malicious code in framework-eris-nuxtjs-grus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b65351c6929cec60563f9d875e745f9066af992685e01872ce292bf993c8ba1d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tethys-cypress-optimize-css-assets-webpack-plugin-enif (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f105b3dd515bd0a46c837e65d9a353f5440a1ee4d2bb6b1800b64e2f8b2cb81f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in playwright-pipe-jwt-middleware (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 755d00753640e4a895e2f9616e2566192bce7cf934e38df290ee1c614da63837 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in remark-dotenv-safe-betelgeuse-testcafe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f67536623e6020a2084816b1ce2ffd1af360a6738503293222726a849783479 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141779 Malicious code in dotenv-safe-transport-corvus-hydra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d833eb99411857bbedad036c317ede897b63d5919e73e692817feacf64b3549 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145945 Malicious code in package-scorpius-kastra-enceladus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13206989ca281bd8486109bca034dcd43687f4928eaf2c88002dbd6dcc613c4c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147071 Malicious code in react-bootstrap-polaris-prompts-duplex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70ab5c4a923aa2e466ecbc96e0eac3c8a5009b0e4895c85f60cfa56187d7f5e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...