MAL-2025-146825 Malicious code in publish-zenith-cygnus-nashira (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 24d084c950dd5dc4f71460664d9a08a96009f6beeb79aaf14ec9c669e382574b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148329 Malicious code in stream-run-script-got-morgan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c9898cba39bc92128e8353f6298e4073eebf5b59f8585aa54ff9d6fbc17669a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in transport-sedna-reveal-md-vuetify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11f033be6c88dcdff6f6ff0908652951a9f0c7c62e2de7626708ef9fbc65f8fe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pyxis-webdriver-manager-colors-cluster (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7046db12c93f852d9af106f281fac38327ff8b7cf8e3aa505fcd91ccefda5b3d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rehype-spinner-wasat-helios (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3c2c259413755d91ab2d7887a4bad3620fb777e89d8391c8ead79364d62b8b3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in umbra-octans-soap-jekyll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9f0d0334ae7410a74f0a261e537a93142679ec79c12d9de6a044cc97119479c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in package-karma-europa-izar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23bdf6b5e512069ce2e5a363f939de73973bd72232bb5ed3e204cf11d25dd264 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in google-helios-tethys-hercules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b34e582ca40ff6c3fd84385edf7a5a72d935036fc994943ba8ba20946675fa6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in magellan-yonder-library-miranda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5cad045e630d35fdfd26cc00256788d518deb53b5889402c0e75ee53451dd16 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in local-callback-miranda-venus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19cd4f765265e09e0202f01e90d9d9707e3c457a83a0d8e45c3fd3ee2443f5be This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hexo-procyon-neptune-spectron-webdriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4619fd351f85f1a9556030bb0bf06dcf219938961232dcd3f091f3f5d47fdb47 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phoebe-sagitta-gridsome-child-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c21ab02f0beafb5fa437dd180f105f309ce3d3df62066c7a2ab2a0177deaa74d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lint-staged-gridsome-less-loader-standard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98a7c959df4560a355bfcd68e15080007566b2e99e74162477598c165db3994c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in neptune-request-hexo-commitlint-config-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3ed02bd25ed21d5f7601ebb7225bde8001cdb1d7df9b1567c9de1530a5417a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in canopus-config-karma-dagda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d2895038fdbbb1d7ed4a9e86b2391fd50d2cca0ca675432738eca6383610026 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148996 Malicious code in update-ganymede-typeorm-nextjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88d9c347f981d0c30b3542a82ff394ac958982da974b04c61e44d8d637fd24d4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146034 Malicious code in pegasus-helios-bootstrap-meissa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 443c660eeccc84458663b73683dd4f9945a478b35f6e205b836a99b218487f68 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139603 Malicious code in astro-fetch-orbit-celeste (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d4a4aec0103e82a9b92eec6da2e2f37912178bf0574e603571607567dc07da8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146526 Malicious code in prettier-xanthus-mira-polaris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c84a4a84f5c6957d09542a7fbcfa103162352aa4cb119d5508f2321327c232bb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149651 Malicious code in xenon-mensa-wolf-csrf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8db5db959af39c9edf8f563ffa5944b303521105744334beef652eec89b55a52 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...