MAL-2025-147476 Malicious code in rocket-phoebe-norma-mui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b96ee1261f193a70b7eb7bb78cefd12edeee6d534a331c98854f83aeddd3e8d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in halley-vulcan-nightwatch-nashira (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c5ba8459812b58b3adb0a734a6bc6f6acbcea1e099036c9801ce7b9bc035bfc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nextjs-phoebe-commitizen-dagda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00c7087b7b287470476889ddc426136442abdab2d013c904a1f9e9d558f3cbdb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nuxtjs-webdriver-manager-nestjs-karma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 552bfefc3abd180f3221957493030336f0321332917a5f0e47b77fbf14eaac11 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dependencies-xerxes-gulp-equinox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca524df6fe30d9a679a3caf1797ead4065707ec93bdd4b4321abec7aa38cffdb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in halley-castor-less-loader-quasar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 975d184b9279a477b2e66964b4dd26164f603b730d6da0b7938958256ac3ec68 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in umbra-chalk-zenith-koa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d9f0749f6807047fc716098a7e59564eff5af9f83ed200b75d93cccbcbbf8a9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cache-xerxes-upgrade-hyperion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 802d7a7f0ae8fc2df51dbbcc7b9cdc31fbeb2dd2584a21fc7a4905eec8e8f72c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in exec-koa-andromeda-google (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ecbff9e6221e3538f5d32ce051aee8f04ba057b18ba87e9f1a0f51ab9d9c0a15 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in polaris-backend-lynx-quark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3040abee7c495e48c1a8af71791a2cd96cf6d49319dbace10478b91cde00f95 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in reveal-md-hyperion-websockets-schema (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47d8c2a87fac657e462b3cf084ceab4d755bb219d31b4880b1d4e1b6ba1a7e25 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in centauri-passport-hermes-ignite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c627797fec31a2a6dae80006e9cf6132ff2289fa44c5aa6e583594c1c76ba70 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ursa-jwt-lacerta-terser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef56c704920dd44671d3c0efe77e25cf3249240f4fe7d77f265fe02e8a816a98 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142437 Malicious code in fetch-chalk-mysql-ganymede (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4eb1790d821ab22ac99c85478c2c0c64e0fa842b8042826889b140dcf3a613c0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144534 Malicious code in loop-scripts-koa-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b8bd7851dd59a18465c76cea03c8ddae5cbf1b88a7a03c3e87200dc9451156a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145999 Malicious code in pavo-hugo-winston-iota (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bfdf061a2794f8911e73a0f36fd0d80603c5fed1800c355ddc0f4ef97e5a82c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147339 Malicious code in rest-andromeda-ora-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8a92c88fabf7123e7ffb64c069cfb3f6a546e509857b2531c764b7e04bf9748 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144127 Malicious code in kastra-pino-equinox-iota (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eda6bdcbe3cbb6ef8ab1bfa09ae585d6cc0e53b722c68e483091d717214b52b4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148037 Malicious code in soap-taurus-alphard-await (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f1d5f090be809b21c5b50628f723d4f107765b7e01ff6e0a5a790938b79adaa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145092 Malicious code in mocha-sedna-css-minimizer-webpack-plugin-perseus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8604a20f4f2d848230348bc9bf7b4018a8578f21adeacab02ee39ba2a9d08702 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...