MAL-2025-190421 Malicious code in yaml-barnard-jekyll-magnetar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 647bcb1618cd7231944ee6afbd42020458061895e8490b3d485d6225634c630e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in duplex-airbnb-canopus-gammarayburst (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 117508a86020268cd81fdae9e80b61bddc41f161e6fbf280a81788e22e70634f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189153 Malicious code in relay-development-update-semantic-release (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d662cd5ff8760a510c47e6ce2df1e9877f2621026be7db837ea4e53fcf873d18 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mongoose-wolf-deimos-forever (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 278e4a12ef49eb23953dc1bea73ef37ad5b5174a325aaebbabb2faba7c8c204b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xo-mini-css-extract-plugin-vega-koa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 341b0fee093a5bc333b9bc719cccccc3a0a2761c15e4f1ae597b33f4a6d534dd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in star-earth-small-execute-decrypt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71714330271c58d2d5c06d8a1ef7ca0ee575d60552bc9bed163a8d19d031220b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in soap-membrane-thermosphere-eridanus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 170ea9563c8b172d76653b10f5c52e414d07daad6ecf7e43ff3f1cb6a7feb60f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in testcafe-jsonp-lyra-antd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 304cb8c0a4bc6028d7409abd3438dd2e2e32758c808c2e52ddc9c45829b586ef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lacerta-polaris-tool-resolvers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e14658508cd2a68cf53158830bd8ec585bd27f436ddb4ef01bbd48b3cf1384b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in colors-rigel-bellatrix-pyxis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c137eaed40b31b6152069e498b6ba1512a5e4a72eca57a6d5eaed47da47afb55 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sed-sed-link-data-root (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ccc8b20dfaf048c261a0380b71cf6a30fbead7edbc4958b753a86208b3b9e4c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tau-upsilon-function-alpha-kernel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a90193271ebae98b6977b41632875a580c5ca8ef7aaba725f10408347fa64fb8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in benchmark-view-mu-cat-virtualize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fc47cd19dd87e3112e036bad1f9a2d225fe3502c682b923334313c3239d36e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in carpo-aurora-pegasus-sqlite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 546ac582d924e3111b56cd0c197fa28379cc4fcd4edc8ea795336dd44a1bd430 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in changelog-unuk-antares-restart (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d90a92b9a0850e106d3410f591ad1745399775c72d60a56b79bdbe04082dc27c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in blueshift-publish-carina-nconf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28c549f3f83be3a9352be7a86dc574afb8bf0d430bc7e01a82a70d38bfcde7f9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mechatronics-augmentedreality-hapi-jupiter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77bf9f3ffa089433f5b69b03685acc2fa84ec50ba871248d9d8cd4ab5d4accab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in publish-webdriverio-event-capella (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a13ec41d982e5391f4a58b51051dc7c843a88857fae8f519de3e3ae4dcd6f643 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in protractor-nightwatch-schema-bootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea7a915975cb4548934f89ccf75e0bc82f99378036e167a09ab41fcb1cf23afd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in greatfilter-venus-stream-halley (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2688ecd07f82607da45c4ce63b5e64aab9f8a5cd170454bb2ba16f0dbd1b5a8f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...