Malicious code in leo-connector-mysql (npm)

The leo-connector-mysql npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the...

MAL-2025-188233 Malicious code in neptune-venus-foundation-hyperion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee152f2d4396ca7e5f7e1a9e8af596f9095773d1fab65f76596fd3bf58c29f61 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186412 Malicious code in csrf-relay-miranda-halley (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f899356aede6a0e064a4ad0d787f45e899605f276b16981fa45ad710d5d7f054 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188246 Malicious code in neutrino-radioastronomy-comet-planetology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c5049737339f9d2c21434a980e4d0f599495860ad89b11345271bf74c80809f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186133 Malicious code in chi-bad-deserialize-throw-static (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7744577c30322c4063fbd7470570b5feabfbb14f54d2d449b1e66ddae61733f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186319 Malicious code in cors-standard-epimetheus-telesto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38a0e58885cbe1280ac15b1de772db340d444deeaad728af9524fe0139441eec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in event-husky-tachyon-auth0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47d6d40bbd46796ffe0433b9e3e0fd88b76fb46ceb7a4973ff526bea29bf1b9d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in loglevel-event-resonance-umbriel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7eec21520de8ed6c0a4d6cca52c2046b026e45372eab13e437e1cd2d38c4f32 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nconf-zenobia-antimatter-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b18bb89360c0342d090cbdb5fad1f11ef5a29f77b43b652798932cb81d9a0a1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in link-cron-simulate-assert-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e256837491141edc7c92e5b82e6fc342f0f94ba27253023fe34abb8a251812cf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in saturnology-enceladus-jest-xml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c71ddba711570c0f93b560b77dc589e118eafa0301b4b1d647ba6cc1e251c4a5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in andromeda-impulse-quasarjet-elara (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e410a4fcb58b2811102f923002858586bc7bc659b7f0faf932ba2c0a1456af4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in subscription-interstellarmedium-toml-neuromorphic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94870bef41024d316470dd53ab7a4f20aa757f5e14a2b389f9389b45f02c0f32 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sails-europa-nextjs-version (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 723695676a287161e3d27b973e94d01b9c7964555c6b08d4112590252c89e581 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in supercluster-command-betelgeuse-style-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75c4312f9a8f4944f7302c2d84d8f462d661b5c52a2451094345926045d0e847 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in visualize-validate-array-hot-analyze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa5405559277835b28bc4c8bb6db51998aa22c4fd91d1ef31c819a28799cc347 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in supervisor-cosmicsilence-kardashevscale-ophiuchus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9573fa09b793a27dc60d132b1c9ae19d3c0b44531783b2302554c24bfa8ed91 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in registry-pipe-version-chariklo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb83a59ef222bd5e5aeed91986f77fa69c191bb0dc1819dfd9eb913e08908872 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bash-unix-rho-sigma-quick (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fe99aa0b7ad9119be18713e63ab9d08cc26a6b086055864547b2748a50896a1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sqlite-oauth-quito-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07ca71d4114f8ae4468c127def1828c69d2b57565bf13761cb5938f72ffc59da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...