MAL-2025-140857 Malicious code in colors-ophiuchus-apex-lynx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fac9084cf98ce4dda9f94e9b7e0f33074d12f8aef60576e6d3e1ae09d9903fb2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in solis-release-it-altair-betelgeuse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60f6978aaa136c6001fac1b87f9ef2f0eb076861ebec1150f4c4c776a2255576 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in npm-acamar-quantum-proxima (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa9b5c9916b04c82c901302f7b2133140245aff21e8c829542aa208b5e2af2ea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140044 Malicious code in blitz-enceladus-ophiuchus-kaus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 367e5ffad151138012cb4919f2290fdc248dd5eafaccc502f6fd5d421ba0c35f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142614 Malicious code in fornax-corvus-socketio-antd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75b118c859ce159a51547289bf829d5e6adb46f1e598638f8044f7c778c3486b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140701 Malicious code in chariklo-jest-titan-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4f4fa5e2efa6b267cf81c7911f6cc457036256039097ea7f0efc376e5585f15 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144807 Malicious code in meissa-heka-wolf-fornax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 303ff4a59d56a3eaa154f024f1234b48e7c42b6f0addcc29a1998dfc7c7cc0eb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141293 Malicious code in csrf-postcss-dependencies-upgrade (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e323392ca38cfedc4da56f983f855457eb4db40ebfc12a16fcb2918fafdef571 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147793 Malicious code in sedna-sequelize-less-loader-rollup-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c21acb639bbf2efdb260ea223c2b12d93b35a5e8077ec424222d65f38559509f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141309 Malicious code in css-loader-octans-acamar-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b5a0eb27ce8f5a2dfcaca555b902c33e0adef4bc2fe29a0608fab6b0b3a2244 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139271 Malicious code in aldebaran-charon-pegasus-heka (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 808b7e01fc3390efda5a9efa37e7d1917a9fbe55cd61b8a33611ec40ce69b373 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in express-venus-sails-phoebe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2233a552474c5eed5adf76810c6bdd4302fb6368b7098734f8aa7a3399da5506 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-safe-izar-gatsby-dotenv-parse-variables (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fe616df749940f75685ab4e34b7cab78f5ad935cee6c5c5cc11d3fcfc1d3820 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bellatrix-spica-rollup-forever (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6ab0d0aa7d82e6b2a28fae89f185a2a5526402ad2a1dbea6452deefbd171093 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in radiant-spica-aquarius-css-minimizer-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7169f32b6920c67feca4879bb9c15b8431f75f889719ff5864c3908dc64c8ad5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mini-css-extract-plugin-sedna-fetch-adonis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc0f3136cddaf05ac4a7fdc9bc9a237997fd35ac94b4b82011b8d0573fd9cd80 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nova-delphinus-npm-janus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 129a352ca92f6102c391ab9f3a557c8fee171e8222da3bdb8bb217a365212865 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in deimos-sass-loader-quark-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52a22eeaf7193178e07572505c50525a46448c1593b64c2716457af244a18411 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zenith-tailwindcss-helmet-carina (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21ac99628cc463df34bb5966523d40dedafbd2d76d2036558ffc840d3397455e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in proxima-figures-axios-shelljs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c531b5df700f19ac865f238ec8ce7f58e318e21efcd90ca2e8b2bd093b3727d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...