MAL-2025-140402 Malicious code in careful_wren_blush-12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc5695272820a4e805fe88080377b4907d706724b525cf83d9c1c2806ce486c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bright-jade-baboon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ca0b7a8fe76c790a8f0966c2d9b1b53750f83ee56f61e330272e75545da21e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vuetify-node-config-cressida-slidev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 293161802f07c9de6661d6fe9613860acf582af0194c832439c21fcdf8700510 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in library-loop-centaurus-request (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e94a394ff4a3c9fe9b4d0840644983f11065ae70f6dded50fb5bd439dce54e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in link-nightwatch-aquarius-ora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88a16ba622475028f46340ba10cf929865e0a4cb88b18410fd926a9315ccf622 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in local-prompts-webdriver-mocha-dotenv-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fe2d138e30dcee8ced95d5d531d2a68c932e8f629abbd4f8a4be48c7e1f521e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in flare-grunt-sass-loader-callback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d0610d438cfeeac5446fc5869435a197100dedbc6fdb810df97d1eb3706ee54 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in janus-lynx-nebula-astro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c58283b03b07b8dc5e0e6a679d5e9ea4d0b397a111371b7e52f2647e692d785 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eslint-hugo-indus-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e96530a9a643952073fff332c1ad656ea9314648258f54a2ba8a5b6cd6ed8ff3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in indus-bootes-release-it-mui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f90ebc335a7deb65c4931a3acab28e00302095cd25fc35c9c9f3136c512ae0a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zephyr-mdx-vega-reveal-md (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fea83eda297ee0d2206429ec6f0badf1cf7ed75ff63d80009fb755fce2112e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xerxes-astro-axios-rocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 715eb9977b60db21113d42c72537866a7b61a77c97d0d16502f45a0c2cfed184 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in morgan-dione-dactyl-achernar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95000699eca91b0ededd51164715e83893012ebc80da1d3d2bd604416d49e9df This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in terser-meissa-firebase-lyra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1882021d75d0b4028b69e92eda556a17a972e548f88f350656c1ebf0e431763 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in acamar-quark-native-chakra-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32d573b248cb4590647cf0dcf614db037deca09356997105e212cb80e7c7dee1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in comet-gacrux-pm2-middleware (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7729116efe483cf849c752a73e89d5216af77a6872c275da676077adbf09f1d1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nightwatch-pm2-vega-ceres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5fa3cbe2bbe8827e4309704d2ee84775a8f506d407ede201a5431c71f8f1e62 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nightwatch-leda-phoebe-titan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e255ef36785234c21c00b9b872a09dc23df76ee5a10435c11ac71e04b7c37b69 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in react-bootstrap-element-ui-gatsby-forever (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4175fec53eb9ea162464df2522513155eda1ce993052c64a2b283b5cdabf86a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in atlas-changelog-nebula-kinetic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc7e2eb2f1733d25f25813a2bb01c686f23d859768bb8ec96a69b2309152b774 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...