MAL-2025-147235 Malicious code in release-it-sass-loader-parcel-fork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c5b769cb83d4424c30fd9e0d87d8ae149c3c2188ae87c28d2c06b4ec5c28b15 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141931 Malicious code in electron-sadr-quasar-init (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad9acdd874d1a9f4ca282ab7f6c2dbd712d999f56b2c92df4a4c05906571c7c6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142614 Malicious code in fornax-corvus-socketio-antd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75b118c859ce159a51547289bf829d5e6adb46f1e598638f8044f7c778c3486b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in express-venus-sails-phoebe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2233a552474c5eed5adf76810c6bdd4302fb6368b7098734f8aa7a3399da5506 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-safe-izar-gatsby-dotenv-parse-variables (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fe616df749940f75685ab4e34b7cab78f5ad935cee6c5c5cc11d3fcfc1d3820 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tethys-enif-nconf-telesto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 799881d4131b02e60faafb9b9e35aa3e419a470cb3672d5b78292cc00b780831 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bellatrix-spica-rollup-forever (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6ab0d0aa7d82e6b2a28fae89f185a2a5526402ad2a1dbea6452deefbd171093 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cordelia-shelljs-gulp-optimize-css-assets-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7027c32eb0a3ba723ebe11ca4df1274d19f003ef78d0984d760230a9baaef860 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cache-cz-conventional-changelog-meissa-express (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d19bafe3c4b592b1e829c62a4fc067747a9322300572915c4be2b3330aec9fa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wasat-public-commitlint-node-sass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86828810b79ed18283b0b316575834d8a621b042d5abb7821c65806ffd04bc77 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nova-delphinus-npm-janus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 129a352ca92f6102c391ab9f3a557c8fee171e8222da3bdb8bb217a365212865 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in css-loader-metalsmith-rest-tailwindcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 005841e6161cc0f0146a62615f6eae5c47197caabf44e0ba61f55a86dabe8a78 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in deimos-sass-loader-quark-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52a22eeaf7193178e07572505c50525a46448c1593b64c2716457af244a18411 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in materialize-electron-builder-deimos-mui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ded8816b3138afd92a583e68ad329661c85d0f0fc367f75c757032f1eaf21546 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zenith-tailwindcss-helmet-carina (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21ac99628cc463df34bb5966523d40dedafbd2d76d2036558ffc840d3397455e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in proxima-figures-axios-shelljs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c531b5df700f19ac865f238ec8ce7f58e318e21efcd90ca2e8b2bd093b3727d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prompts-wasat-charon-cosmiconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8812a5f00b2abfe082d0356b8481321b48341d4051a93e24483b59a2c6ad66cc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in got-rocket-build-callback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 028b8aa4f6185b93d879053833468fd2cc925423325abe587d94abab54db54f3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in local-aquarius-callback-airbnb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0de1111468dd157dc24fdae11e31d4d41f4cb9001bc90e624802b0b770804ab2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xanthus-colors-umbriel-avior (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 816e1c6b313dd8cc06efc8b2eb7332f267ca478a69bbcd2965f31859ce9b0887 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...