MAL-2025-141440 Malicious code in dactyl-flare-galaxy-galaxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf46e48e76d6587396a1177789bec4bdc75522c87f71b961f23e88989f9223e1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144757 Malicious code in materialize-titan-start-morgan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f008e3b88825c9a54a226f489afb5844e6528c5993f15a38561ed9d9583853fe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in materialize-meteor-frontend-centaurus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c1f0cc1a5f9a889bb9d25e3c44471dfb495105e55f34256120a75de091f1531 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149503 Malicious code in winston-jwt-sails-polaris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector deb006c2b2793dbbcbe5f7a7f5b52c5850abecd1b69042e481b38dc15078b81b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140569 Malicious code in ceres-kronos-warp-got (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46463893d487d5780c5b22490344844b9a5e96f1b8502d896a2839501e0e8b79 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cluster-auth0-json-dotenv-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 772c519c283df8f248742b2b97fa33752794ca5101efa6cf8fc76a445d26e100 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in despina-regulus-css-loader-antares (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2f1aab80e4cce0b81ff5effcff1de0ccec604fd14553e05141f232ef3aa99ea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sedna-metalsmith-vulcan-yakutsk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8bb66a7b11e61ba0ffe2e0d0c433ef34fa0d555fc5381ee4c86e3f70147a06f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in apollo-cypress-hugo-capella (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 758c19faad9f0ce115ed507c1f4121e5682f2b0efd2245660fdbc2de7e4f9914 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in commitlint-config-angular-ultra-ariel-nodemon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a5ad258019d17cd509e8f6df52866f9c59c14140aee5a0bc52dfe9f6b0071a7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in changelog-rollup-proxima-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbce01fe12dee0ad06db12fcd44184e7a2fa4e4ae51be17a138168babedebe9e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in writable-izar-tool-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3b84bb1c43acd9f7be1bce6187dc6ca90f1e0eda7e28ed138936ede9ac43384 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zenobia-repository-leda-transport (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 981e8d98d6e6d2d4ca979cec06daae154629947abcc65d784a87f4ff49c01376 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in charon-semantic-release-vuepress-centaurus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e776ce46c469c74d1a6d1ea8ed87881272cc29267c4711ce8317e456a0a9466f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mdx-sadr-chai-npm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddb09f5e2a7704baa6438a141cf28d13bca7213b991283293d34302c18bb1c7b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in envconfig-halley-despina-barnard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48934d339f8bef386426802ada777ff1e8a39e39111d761252b18c165fc55ccc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in superagent-castor-mongoose-morgan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a95f0631839de65b434dd57e55267fe235f40bd313d648b5f82b9a93881e7ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mongoose-pavo-arcturus-csv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdb3646c653052b4f7657c65572c429be051821f24a9fb82a8bc96c3fff2cd0f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in module-markdown-nightmare-deimos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eca582e2ab4dacacb6ffee3192229d9da9efc0e23e40c4dbb0ebb1180aa5bf3f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phoebe-rimraf-transport-gravity (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d320839b4d250dc51a6c8d4afcf02325f2d067157ca501e732ebea5362aa8ce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...