MAL-2025-139315 Malicious code in alphard-altair-jupiter-stop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfb92c5e4220e85a5166f8dd8864e3cf2ef13901c30cca040dca1b12763f4c91 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145066 Malicious code in mocha-aldebaran-sass-loader-antd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e4e7e98e5605c713059061d8faf2bbea600f5c269f0c61c5dbfd5a723d4c601 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139271 Malicious code in aldebaran-charon-pegasus-heka (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 808b7e01fc3390efda5a9efa37e7d1917a9fbe55cd61b8a33611ec40ce69b373 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in less-socketio-loglevel-carpo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 260abb768f8062126b91ed7c1e0822ea7d2cd0490e64c0ef6d0235f618e5ccf1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in indus-transport-chakra-ui-ini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f0eb7248cd20ee36ccd0b350420bf69534a17a13b0db05b2cd3248e73702f75 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wolf-antares-uninstall-impulse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f37908e13e3b9b904f0430d7825adc9afec6ae30f58f69e0aea1614bfaa2d854 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in uninstall-acamar-supervisor-cassini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 465df38a02f20b2ca2a8a698edc1288e4f1dce24d0e7da6a996f5d02dacbfec4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cli-cypress-chai-geckodriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 725ff2d2b96632a35efed8f0bff6ec9fab20413ba556126d0656b49c0397a126 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in impulse-adonis-lyra-pino-pretty (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7ca4591578541b00ee189827d4e9f0a0dc42ffd41bb91438b48092b3d41e0af This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in yakutsk-registry-phenomic-node-sass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1fdaa9233220cf2578294c4ddf85f8c5f7ad591e9f946ecbefb1ad500110f7e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in janus-sails-repository-repository (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b717e4890005e4ec07be65f1916406d5749e4ad38235d36ddba0bc9d3582e320 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cors-chakra-ui-norma-callback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a6583e3fb97f1c660d5acd6273f78cff0fa61a0737fe5b0b5233e8b582d2659 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in titan-less-loader-mongoose-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f435d0c6225ef989e040df7f6dc37a6312c0b5c425590180a80e65fa144b165d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in node-config-vuetify-less-loader-version (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 413d8078725859d1005cfce9ffe26542402304c431c1b404966f75b708ed7d35 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144109 Malicious code in karma-gridsome-backend-hydra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 310d0539043ad82350363d64d301dab21bc3058b5ed8f2b8c40789257f6e6992 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146069 Malicious code in perseus-blaze-ganymede-levels (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6c36548131bc59eca950e04d1b40f3421ac426a7189a8aa205124a8688d65eb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149673 Malicious code in xenos-airbnb-quito-cypress (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d69b73f1b84b812f228d10db72c89f610a6d993790e55508b9dfa9e24ee52e9c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in testcafe-xenon-chakra-ui-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e267c663a12b26a567a3e6b07f7a2e36b7ae20b41b5d94b5f4b655fd5f09d444 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in procyon-wolf-middleware-resolvers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4b4bf30966429dc013b6a8c5fbf7f2bd149e3f37da0518784c5d4f6d5e13747 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149560 Malicious code in wolf-pyxis-rollup-subscription (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 825b2089e674a1b4f07d988dd4dd46073f675eb1896bfdf21ad1489f1458389c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...