MAL-2026-10349 Malicious code in nottuff22 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07035c6d64cbb510ca87260a3a3ca216e2ddfcffcb0ffba6d40ba9f8444c5e0f The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in config-pipe-promise-start (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f02106f4c3f458d8b414958c8d64a06a816b5900d86f0c97e5f3832b61b9f28c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in weywot-tool-eslint-config-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de32a7540b8c3b3d21739c05102b00d5a46e140039e3c22f2265e6addf4f43d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in arcturus-bellatrix-standard-miranda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7609f325b00b45170897f239a83a8f9f0a9ba0025c5dc5641331b70050b2b2ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in antares-cluster-ursa-javascript (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d84a4b00a7033fc3fa3800a11c657e0a534a6b461ccf0deda2a4f531f6b3468 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in postgres-on-sqlite-archaeogenetics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 742c3f14038069f04c50c352cbd97d098d6f27ab665f78f595fced9e20fb1028 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cryonics-magellan-bionics-tardigrade (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f35509feb00c10d70419411c894a45931a339c14f56fd0b061b3718d5ae85a12 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nextjs-quark-supercluster-nebula (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a90d735c27e0fea07e309e14b317843ba0a808ca21036db6ca3f73fe52b2d01d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in titan-link-wolf-unuk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5635cb19cc5d81c41aa823641a3e6ce5b8e942e8d03a61f99c85afc4412e62e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sadr-cosmicsilence-paleoclimatology-despina (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab6e28b764f010592962db4d96f68cc9d1486f9d875274459745f1bf160ea2bc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in figures-duplex-magnetar-await (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3eae1d7027882b6a70265a27433bb8857139add8539583e992546d667debca8b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sedna-shelljs-tailwindcss-photon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a5705ab9dcb1d6154f909da22e40f7e97327537bc2e24903cc8ad7a9269aaa1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in draco-quasarjet-envconfig-technocracy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e035ec30a3e6a4899aece76133701fceaa81f84eb4de4b1f3e1a6500c33e84ff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in earth-omega-epsilon-error-compress (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 947db336c7842edab7a9506dd0ad7679dd256b4f6583d8acf5c916ea9a792645 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in europa-augmentedreality-redgiant-halley (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e016ee1a0dd17c2e68725b2ba976f4a101ae5c9a4b06daee9cc37a2f540c5009 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in monitor-data-uglify-compress-book (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4fc316f02dce0d561bf90ab32d3702a34a86ddd60eb81d8893367f9b0125e9f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rocket-fomalhaut-sirius-kronos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 344f2bc058eebc6954eb5e9126619426a4e49a9670f2df757ea7590314e6af3f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in thuban-run-script-octans-eslint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41bcd540d3089d4cdee49cf3fc5e84101e85b4b10116b145f1f13927a252e045 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in update-tethys-query-mensa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c9cdbc0040f0ab2939ef7f69498168277de65baee517b5eb4aca16ce150e5c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in scripts-chalk-nodemon-eigenstate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85ff9d37ccd592d5799db1e3e194c0c92dc1adedeb27ad583add87531d2bea23 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...