MAL-2025-146964 Malicious code in query-bellatrix-helmet-spectron-webdriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea2fcbba4aafcd8739a6c5c1f7fb79638cda46c72a032d077c17689398101f49 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148450 Malicious code in tailwindcss-playwright-lacerta-hapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1208ff45dd006a097793072c093d443a2de50d88981ecb93b4111e96b46ba2c0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148438 Malicious code in tailwindcss-altair-pavo-jekyll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d86fe2b5c9951a31ac9bf3e5536a7fc468a21cb1dbdcb6e12a8e3f736aede389 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143049 Malicious code in gridsome-orbit-sqlite-redis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7457bfc70c4639c65ec616e7e6c19be1ebf923ae82efd9a748be1d226a51b7c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141548 Malicious code in deneb-markdownlint-venus-antd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9072afaa134e1e2a0c8fd4b490cba7e97b3f7cd3d0a7707a1d0e64a8aca1f89e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phoenix-ophiuchus-webdriver-mocha-zenobia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3cc99ba026da8566d257a516cae1495a6154a7a20dbfb8f5dcb605c6e138958a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in heka-private-electron-builder-gridsome (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0efc83769ffc86634fb8641fd68519805cdc2c8c3d59fbda9c45f154c7b48d4d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in websockets-run-script-websockets-mira (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b0a70a318c20af9d9bb70ed07c0a0083fc5f959e1a8d806ab7edef580115498 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in non-blocking-kastra-eslint-config-babel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6733a63686f84a737c0a759a95d9448142cd5dc89513c785f1f746ab028b97b3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mini-css-extract-plugin-meteor-private-thuban (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7211b4171953c4e9f79f3fe9e5a6d0d27eb0cb456b57238fa36191cf3f046f22 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in protractor-rocket-terser-postgres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6784835499ff275075838e347dcf3d09c0983db7b6cf15dada34f13e5f0e66a1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in oberon-sadr-stream-solis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 340278f68496efeadd003e04f84c930a752735bb8c48821c11ab92fb0fb0c98f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spectron-regulus-superagent-rollup-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdc13f76788773d5d2e87dd70334fb448f2b74ba088626599ff5a7c8a2cf7481 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in local-hydra-lint-cypress (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7b2e5960bce8d385d01b183ea5c0ca4d1c4ca826535303e7e7c7c94726b6e58 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in npm-nodejs-umbriel-buffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21c976dc4e8caa65dad055cd3ea3b6bd8738c7eb21895548d493f81de4dcd32d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in achernar-spinner-phoebe-callback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d399212cce44da716b4453d28a2ae282d63b656a01555bce4c82940730649661 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ultra-exec-event-miranda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 441716421f5d5b913842f86b85b33d31d07b792fe47e55353a179bfa02342063 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ini-wasat-react-bootstrap-javascript (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37bcd35eba4a00c390477b1fbe300caa6a78526cf8dd7a566a6fbbf3720279f7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in exec-firebase-iota-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94332727a2aa8c02e041f58ca774af62ff4e6988d385e78bdc86956bf5f7f31e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-parse-variables-nightmare-aether-run-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 293766d85f705540910cf4c7fa5b34fed1ce2705dab395aa9b0d51f30ed0ce72 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...