Malicious code in leo-connector-mysql (npm)

The leo-connector-mysql npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the...

Malicious code in gatsby-enif-tachyon-prosthetics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd3e1fe40b9f4663cd8b878d886d2d8206a84740ad4a30ca7055e0b73b99ffd0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in proxima-thermosphere-weywot-websockets (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2244dab451a96c625aa78d793fcb3ba1931ffe5080498587c46c6bbf7f5a3d62 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lacerta-style-loader-mini-css-extract-plugin-less (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 222914e44e98bf610164e7ab4d3b3240a1bf355716c59e8661864f5d3de0ffc6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in upgrade-mesosphere-slides-sirius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a91873a5b873df3fe99ee0ec6b44cc1d4008c8bc74886676ad22b1e99b5abe9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in registry-pipe-version-chariklo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb83a59ef222bd5e5aeed91986f77fa69c191bb0dc1819dfd9eb913e08908872 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spinner-command-solis-taphonomy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f267dbc36ff88fe19ca4064f576af5fcdb398942c5d4cfdc639f21a86ed1935 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in proxy-cache-beta-iota-water (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62ea476eadee6f737a5d5939604779845fb47a080e38fec660f39ad6b1e818e3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in local-cz-conventional-changelog-cosmos-quark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3e458e633b542e7ffd2b0e112aabcc898fbf435cc944028d735d657c238d16a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aldebaran-quantum-babel-steganography (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e432f722c7db5ff51f734dd2a1307f770c81673653a4f35fc65218ea770c1f77 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in supervisor-cosmicsilence-kardashevscale-ophiuchus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9573fa09b793a27dc60d132b1c9ae19d3c0b44531783b2302554c24bfa8ed91 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in markdown-dotenv-whitedwarf-decoherence (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5aaa9a0b578f1e3065838d076e1317f2e55e73fa4a622e040910b8fa3e0bf73 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in commitlint-prosthetics-altair-magnetosphere (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60bd81e041aa9a99e170a706cfe17847a5bb8cbbb63413017b209781241701fc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in subscription-interstellarmedium-toml-neuromorphic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94870bef41024d316470dd53ab7a4f20aa757f5e14a2b389f9389b45f02c0f32 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ini-quito-stratosphere-slides (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80addd4c113b2cc5947537311ac67c987723ef1ebcd79a98f25b63fe603be5e6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sails-europa-nextjs-version (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 723695676a287161e3d27b973e94d01b9c7964555c6b08d4112590252c89e581 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in corvus-darkmatter-titan-version (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ee347a8414e37c2db0dd852e5fcce8e90db1d785146cb6c111173d9d2a5b048 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in thermochronology-dorado-epigenetics-regulus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 034e0a5efad44fe0182851d4a562fd019601e48d07bb5419b41afee84aa46b1f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in futurology-cladistics-paleoanthropology-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e80ad274cf804306e2638784c2803a3f7125c9bcfbdaca2101e592d240ffbe7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in glaciology-wormhole-cz-conventional-changelog-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99a8e1427315241f9ca0e6b823c4472689c97f4ce67871133412359ec0964a80 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...