MAL-2025-67157 Malicious code in cheap-lavender-chinchilla (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ad4c00b2f73e39731bfc44232196d4517bceb4cf03bcf9d70417bef651fc1f7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-69438 Malicious code in misty-brown-shrew (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd09feb7a2a579e7b92748f5f775d04c0c7e99faf8a998b625603fd082a4c101 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in weekdayy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df956119036e407b8a96a30e171e0ced3fe42699b074b8117b71a5d9bd97d78b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in shocked-red-earwig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23522942de8716a17630603fe9ccf43c37866d452350cbd485e3a805b10505e6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in flaky-blush-spoonbill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8431769404a9a8f35c84ce32881d885e272581911b60c40bdc8a75f8b544a562 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hostile-rose-crane (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fc544884a9fcfa4d0ca3f4823ed7420bf54e49d5c0e2a0c3d3e1b5ee9ea17f7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in misty-blush-planarian (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56f15531f98c11a93d554e7c6ebf1e705870481548ed585c7c8464e7ac743ea5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fiscal-red-tyrannosaurus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd8452a9f856592e29f975f1346644eabf54a04d55b1d9122a6d09b32cd66ff9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in legal-harlequin-quokka (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5cc360feeda1b4538ddf6f00720187307bff9545511f5d801b2b33253f4fbc7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in filthy-magenta-octopus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a06ca7919c538ef77c51f5da8b7db9e5ffcab9064c32bea3a3097a69cbf2272 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in motionless-coffee-centipede (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a979306220e6542b0c8d69f78472cedcdee4b67e7748a5a3a7af813a4e085dfc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in favourite-aqua-toucan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23f2287692e40c7f9b1e99669f3d033298d46da070eee4a5a5160d0c457dd9a0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in involved-indigo-hedgehog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc6bb2d3ac13ec0b744fe1e889ad37b7d5a5ca412960c7287fd3881f10bbddfb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in grim-teal-skink (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd8c7fefc408c7546dcd7614814d77d99b7a17ce124a51df2ad9484e9fcf2180 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in confidential-amaranth-parakeet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f90a450a0a8ff334a5d41905743c9a7984981153b9c71464c5c09768012ce5f1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in @bipyruss/bipy-calculator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fd1ab3b131030644d495da62cd912628c876e2afbcb31d1fbb4cb56d5b2bdec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in boring-indigo-worm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e3e1862f32f2c7cf3c5431a4ef7e7495e88dcf8ec288584c903ced7e8661ebe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dependent-indigo-platypus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d048d0b9a95f4377351d1aa507722738f99efe4dc01640f006557a1988c6ac2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in functional-turquoise-crane (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b541afebd01471651746bb5347128897b6e119e38f481ac4c3d48b5238526f8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spare-indigo-hippopotamus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba99ae7c1422e3987e32a11ccbee5a19f7d32328a3d9d113586ed4606b9b10c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...