MAL-2025-149242 Malicious code in vulcan-kaus-deimos-nashira (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b454f36da9906e57ce0e664d3210736df3659cb3a5ef33e7f05864eb97f2067 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147949 Malicious code in sirius-eridanus-slidev-xo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7427c3c55cf749fe9f18beb12af7f752ff375d04209fdd944459a4648ab7a75 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149898 Malicious code in zephyr-umbra-eleventy-rehype (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c17faa8855d7ed0dd8bab2618bf7a645f24228a6533ac85cfe665cd7182c915a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139956 Malicious code in bellatrix-rest-blitz-style-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92d051a410ec4e152e8429393d4f69c4e39cb62b3f53704d5f7a54d4a087b454 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141682 Malicious code in docusaurus-winston-ultra-neptune (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21c0adced646e6c70706e3732d3afd115a1f845fe2c37252c14fa68db27c94d4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149299 Malicious code in wasat-restart-loglevel-carpo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 574c669fccaa341ec62ffab852152064911a73868724f75a4af37737a8830674 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141556 Malicious code in deneb-regulus-fork-morgan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73c6bd79fffbe62f81884637a6ed985b2a9026e1237ee0222ae438709e8275e6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142279 Malicious code in europa-lyra-aquarius-sagitta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6306362f7fdd29dade449c58d4fb87743c3fc83a79cfb181cc9c54bf93e4b28 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142963 Malicious code in google-izar-venus-canopus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9bf8d605d34cd93a89aad3af158c04ebc00872639c4117254350723c6002389 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141917 Malicious code in electron-fornax-testcafe-centauri (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25e6fd8c4dcf774ad276826eeba711a2d2ff461fa4ae94f3b74e2d259b6c1d29 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141319 Malicious code in css-loader-terser-rimraf-lyra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3369b39705936e81e044143deeb3d264e0c799da1d7145d7a34a47964089ea30 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145163 Malicious code in mongoose-prompts-spectron-lint-staged (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 664e602c1c1f17845de88222beb490ff65a987dcab2ecaa0d720d4c748d9beae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146044 Malicious code in pegasus-nuxtjs-nightwatch-rigel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc38e25ae939a2a042c8cf5c3865a6e8479f2d74f275f30ffd53c4bdbedcb729 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cache-eridanus-auth-perseus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2ca0649729d1dff4f07747f531200bc22904d80ebcbccf330d3a9a9072f5251 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gemini-wolf-subscription-adonis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aac34b37db8f5230563ed1d7c9aca5ba4992c6274148ebc27c70174dcc389fa2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chariklo-ignite-less-cygnus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c288fec2d5387765684208aa7cf6ecab742922ab14ae5fed28c8176b4093ae0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in thuban-optimize-css-assets-webpack-plugin-phenomic-grus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53ab4b85405344cba4e90b361e9ae9ae928962d61cfbf639267512dbe0ae9d23 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in electron-builder-async-hyperion-eridanus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18b6089e45b3bf30edc036b6652f4c1590215d51ab6b5f80ad7b9e3adf40564c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lynx-superagent-neptune-venus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f96e51531e573a2c554dc865f68992d1f2b7b5668f83722fbb84f0dace0aca2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cosmiconfig-release-it-betelgeuse-commitlint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd8df59cc076ff9c49da6ac43f3320f5cb7a81a307812ce3527b092acaf0a9fb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...