MAL-2025-144516 Malicious code in loglevel-morgan-quito-altair (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b50eceb8f2f21dd242d94b879f4e4a8c0989e6f0c6d6dd0799bf6e9fcad4ecaa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in iota-gulp-colors-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8431bf4a128360ee6043e7c52edf66bbce754f42425ffbe398556515f7563293 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in readable-heka-chakra-ui-lacerta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ae1184dd4f60e3b2275845574ebb643cb6f3a70b0d5d35c2daf60368109d82a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in relay-changelog-webdriverio-pegasus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b0e59c7d74bb68f1c08f1fee54f8e1295b7afd6445c1ba26ecea6f7b75a3365 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in uninstall-comet-orbit-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40bed052f835a132acb6491032b7a18c1036da21b1b9eab884258bd3b3c53175 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jsonp-sagitta-proxima-adonis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa753953218b29386b71fd301e0f77b7ee751f4c3fe229d8ada58d8b4905b054 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in virgo-gacrux-geckodriver-hapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b12e7d14ddf41e29e1fb8ff69e185df8b7dde2a9990716da9dd7599617f6cced This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in io-magellan-passport-kinetic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe105f7d3d2143861bc708e763b757a9213789de31bb48056bdf89c9db6fbc76 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in quark-bunyan-cache-delphinus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a502d3f6c16de1d61c3f028f38278214faff3d2fb4db6a0eb034fd5efbace5c3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in janus-callisto-colors-mocha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fbebae1be459a44b6204915a1718da722ca6919bddd78b6ec4410cd9fb6cdb8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cordelia-node-sass-titan-janus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0aba470b153d913a8363811c0bdbc4300aa4833b9a41af28b0d7a3c678ac301e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aether-mysql-eslint-config-html-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e723bdfeb0ecf0f7b823a7630a67f5018f37e2669440510b547ed98b4e60b807 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cressida-sequelize-wolf-terser-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5a46a9c2846a091e28a3a4dc8c51bc71bdde5de64a5745a8b0b0b66988ee9a5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in airbnb-gacrux-concurrently-betelgeuse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f902fe71cb86fc56849ea755fcc2c4cb1b0f2d2b8b5e2ba0e79f9a3113e4a17c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in electron-forever-cypress-proxima (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6bec960c5d2c7b30446df4bb08b2972ef4d36ff312d03c3c4bce4b033e08d25 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nestjs-react-bootstrap-dagda-geckodriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ab8f182e93ed124506286a8c5600abd6e108c7e992000981c8c480610039da7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in buffer-stop-dynamo-docusaurus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5ec4f8339a37679c934d37c9ed98362b947cbb4b526801422f341815e3d4c78 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in quasar-bulma-tethys-capella (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce8e67c18daeeacbb5f975e2833c77be01cc75cd8706f8f443d850d65db26167 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chromedriver-arcturus-pino-airbnb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7270b9ac19aad85ea7e97512b7bb3c2f8a2d344649d14905875aeec372a852e4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in algol-prompts-meissa-karma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7444d1efb910638a58715c22822c78fba1ee61e841b95a0f0f846fd5a6529fd3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...