MAL-2025-154696 Malicious code in dioago-kamoli-aila (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0af68ca56fcac253020b03840bf8e420bb3c097e6014eaa8d1956d768219842 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-166565 Malicious code in syahlan-poke63 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1c759dbafea0260f5c81d3f0e31d6d3137f07b111ddd7618cfd792b7d881358 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-150752 Malicious code in @miptaa02/irdsis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7998fc2a3b80c790febd333588245044351a06ec14e1742f7761d719381cf78 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-154436 Malicious code in diago-klp-kabla (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b077466943f59800867162d56aa8909f419004c29baec35e928da7140a1a3aa3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-156199 Malicious code in ilal-poke91 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0629cebde072443ba1f443220dde9673b3150a80fe60f7daa4195ef71167501c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in comet-fomalhaut-dotenv-safe-polaris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17f68828d1211166a7827a25bbd5da1c86e3d89362eb6275cf0f5ca8e89781b8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cli-install-hercules-prompts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 449a5c8ab2a770e90482ffc3005699c09647254cca1dfde7705de5dde90523a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pino-foundation-norma-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49315bb63638761a8dbd289a4cf8e22369803d71be237d59224742f28f2b071c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jsonp-ophiuchus-sequelize-miranda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b83722a8dd44906dafde5c5ea37d93ded30e736c4fcf990f55d367c46ac21943 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in non-blocking-start-sequelize-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80ffed84011da7ff0250f24168284da93d72934329a901ecb2db3c4fabc09fc6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jabbah-terser-webpack-plugin-achernar-radiant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1e454a3b4f4d5c66dba0bfc9697d1034ffa85bf2cdc3a171bffaa936b9ac57 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sass-loader-lacerta-axios-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ff96bb432e59f1814f6243a71d0cfdb66f94102ef9409c18ddc27145e2d95e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rest-hyperion-await-phoebe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd3be05d1458b5599c326fbc3293c83e93e49d0db9185fcf229d5a2615ecf53d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in command-fomalhaut-neptune-jekyll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d78ae16521163a3ed5a492595d96c7e26cff5740ec79450c7dd359b6f060c4b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bootes-algol-promise-spinner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c7ecd24d6f9ae1c5ca13e4b17049e81ec3ef27ba44ce68a71635520d7ca1611 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in less-arcturus-charon-markdown-pdf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22b08baccd9d82c30e5e6c477d773783cfbd6d66f0cf6dca7d0451eda1e7cb9a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chalk-gulp-helmet-andromeda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e819892ef4c38110723e1c2772e4b9b3e9b6d1168ce269f008df5ec18f81a7cc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wasat-fetch-event-airbnb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e1ce1e12bcc903510a892579c99f0def360b8da6d761f716adfb0b174868f63 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in npm-scripts-yildun-element-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 607dd731dcd56849e968a6e9e86b62addad46203ff051dbf6fc7dfc4171af23e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in promise-cressida-link-html-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55087f73e61906bf5e0de5f431ab2561dc61d4dc847696b9b09fb2b7b812ef23 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...