MAL-2025-149155 Malicious code in virgo-gacrux-geckodriver-hapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b12e7d14ddf41e29e1fb8ff69e185df8b7dde2a9990716da9dd7599617f6cced This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147755 Malicious code in sedna-cache-toml-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef962dc2ddda4a777d28e0c834a6966b710012d753d59593ea58cb19c23adde0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fornax-umbriel-magellan-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0454f934f08a86179099a311432b199c211ba455f7670882bbf00c0940347c1b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pegasus-geckodriver-octans-kaus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 167d798242c1736c657d16fdf8c788f38667bd86fde31f541aa0f72a178d594d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in helmet-rate-limiter-superagent-umbra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4ef1f11565aefa5ef4b769785a04189915aa6acbcbe8bc7e233fc7c62924926 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in magellan-levels-cosmos-solis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 957abab5443e840ee76b54749ad669129e27ad532cc338193f5a7d00b3136e07 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in axios-despina-karma-duplex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8151d5ca59d464e012a81354c3926da139a00a0f8ecf51fe736ffc94d0ebf35a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in yildun-materialize-proxima-puppeteer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad786dc16177a4cd5009a59ac2e5b60390ff2ed67a4972b4194d5e84a0b9a041 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-safe-mini-css-extract-plugin-pm2-buffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b74de89f741715d26b3fb5345a112775c3f2ffe590c13e624675d8781f49518a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in luna-ultra-fetch-odin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f00ed8cbc51d9cd205cf472188ea84f2ab444b56ddf9af825ca395be404fd4c4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in react-bootstrap-socketio-nestjs-jsonp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0592138fd44852686e120f16bbef78210aec4400631292160c14d54c5156ef1a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chakra-ui-indus-castor-betelgeuse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 559b6440cf8de7895eaea748dfd87f39f1aa885f93498362d0745a609484be05 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in scripts-build-ganymede-altair (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dca854d6df3b48be4282c2ab22c37905502a03ba15db1d06cb12e79768d8d2b1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in titan-chai-heka-lint-staged (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7e8f2fed5c2b90a4dc02ed95b7779ca58c2be25e2092df0e018b44bce9f349b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141907 Malicious code in electron-builder-leda-astro-restart (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d66f13bb1ee8af20bc55eee9c56fa3ad914ff33aea7d902a57b02f6c1cc34ada This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140176 Malicious code in buffer-update-puppeteer-koa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d5463711dac655828a2734f0815568ba460f52891e78f95e73fc8bd7bb233b5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140492 Malicious code in castor-procyon-nova-development (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4634f3def88aa52f773325b3b73a38d6f4d42314962303a0e9dc8a99ed25ce34 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146299 Malicious code in pm2-halley-vega-eclipse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ca1d66ecbafe685efc60a6bc86dc19f0340f58aca3c399a481f5b650b9817e3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146993 Malicious code in quito-flare-convict-thuban (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00913964ccecedddfe2e3bb060c9fa01178bc6ae6a3380252964605884d2c7d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140662 Malicious code in chalk-yonder-cassini-rimraf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35fc973ff9f6a19482ac444a7c64c0fcfbb6272d763d836489c7c05abcfa6ac2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...