Malicious code in ursa-rehype-charon-eslint-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52264c975cef4451250a9b6d544e252385448007653f0902b60ebcdf3ca76211 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in backend-ursa-achernar-react-bootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28154fb6cf14fc46227c7074418385889b26097c09010124f744fee0a02f2dc6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in warp-xanadu-nconf-vuetify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f1a6f890cf0e2133ef4b2bfa33988c3f3bba177346a6626af0630d5b8c70f53 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wolf-pyxis-rollup-subscription (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 825b2089e674a1b4f07d988dd4dd46073f675eb1896bfdf21ad1489f1458389c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in duplex-octans-proxima-aether (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63b3bf319b92e4a0abaaa40adf046cf088a33ab1547bfe298f363a01dbf049a0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in metalsmith-iota-oberon-schema (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77f64e3dc0efe6c5576461c566208ccb68e9e5cd7aa713aad83da487929f293f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cypress-chakra-ui-umbriel-gemini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6da7a0c50622f6f39f61b3b41a7ec2cba924eafff2db61daeb1da12326ecea8b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in magellan-selenium-webdriver-manager-chromedriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbc85defb5c47d81a6b7152dddb64836d50ee11205bac70928844a4534b6d9e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in promise-castor-pyxis-pipe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11e998a570333fa94903c03deacaff2fab31b844d926782cde24c805305d916e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prettier-stylelint-sync-install-loopback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ece92b1dd079caff78449aa863ec078a14cb7bb497a5daf13a2886682585f50d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in less-cors-bootstrap-lyra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a625b4f86ac38833ce2bcd8b9b3317525645addade1fd9703904c39a78828bd7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gridsome-dependencies-hugo-ganymede (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34cb118dfb512914757607f2581b601773b46370aa44eedf0fd97b506eeb430c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in superagent-atlas-thuban-exec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e878b4e6fd11733f8146f15b3f2adb704edf92f18598b0e9acf12cafcb3a9c8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in betelgeuse-betelgeuse-unuk-buffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6dff0b97626e4ee33992315c9e755a79a6adc496b3debbe0e513225029979621 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spica-radiant-await-docusaurus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d9f9a3f881cb11fe0d8855419bcd6658ea71a4049938253b6e9edb76c72d7bb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in proxima-quito-middleware-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 475f449d7bd5dce4851ae837b64f10777414bd115d80a9416776f5418ac55b6b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cressida-redis-figures-regulus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 853d0818e04260dfdeb005b6f14b23c93dfb6a83530ff481737aceaa44cd7d42 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cors-registry-cross-env-alphard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 097b8707ff937202a007e6ec522d6f0159c12a69f763bba77779bf43607923ad This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141440 Malicious code in dactyl-flare-galaxy-galaxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf46e48e76d6587396a1177789bec4bdc75522c87f71b961f23e88989f9223e1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in materialize-meteor-frontend-centaurus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c1f0cc1a5f9a889bb9d25e3c44471dfb495105e55f34256120a75de091f1531 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...