MAL-2025-165442 Malicious code in sabua-muyago-dafaaiffuma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 338d5ac6267413e08fd88c59fcc14b793f31714fe91e1a6bf4f3ea8a34e30c3a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-165319 Malicious code in sabua-muhadsfufi-nya (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9db3682cfc979972b21ab4fe9a6869c48c765a235d311286a119b7e5f47ec12d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-169981 Malicious code in uinsu-lotahmi-nakaimlu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52bfeb10f9953484964f71f102c5039c7a42bfe803828711af6100a21248286f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-163868 Malicious code in nuilava-dakaogfrae-nffhaha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6ee396b6c43c66cb70dcbb55509c31ba3fa49f7391557ae0f59bbdc09b7fae6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in winston-nodemon-electron-builder-rest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bd4fc533ec723fb7ba42bc781479f72f08c672242f24a09e80136673b1b2b74 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cz-conventional-changelog-comet-prompts-link (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 504ff9d0a1876739fc8a79596b830b0a92c29b4ac7fa97d300fa5358b1419756 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dione-cluster-hexo-helios (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d8497ec4c25a6c9e25ffa655c0a28de102cd03a2893bad483366653df906f49 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141531 Malicious code in delphinus-transform-event-mira (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0752736ff183a84118d0c03070f6e93fb04f2b02c74e99d9c655488c1f9a590e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149781 Malicious code in yakutsk-wasat-astro-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b08c20be557c34929f5df6c7e5cfcceb8b208ffe3d9dfaaf04557cee7aae0a1d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149447 Malicious code in weywot-triton-wolf-sedna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 323c76a23fb4b2ec2a76ff4c94f687642511b026eacfe0b07ee54c8f8ec80fec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139837 Malicious code in axios-protractor-loglevel-warp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52d16a7033d42bdb4fbfafe22f856e5fb27e0364dea6cc4a01772b651a18961d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143324 Malicious code in hermes-relay-mensa-rollup-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41b7840f7cacb1472b789652d724c055490d06c02148c37251adb38ffaeff035 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chalk-xanthus-repository-carpo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e114af5f4c3f34ce30645b799ef566a3aed7d0a103b438d1a2fc83cca45530d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in meissa-flare-thuban-gemini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46e1b7982a0ebf5c13945e41d69ca106c0e229e0026f308ba872bea0d4985002 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prettier-stylelint-sails-eridanus-html-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8446d0b83907d6840faf8bd380dda83cfec2d30fd3c7af28b08d939813dfa0fd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in scorpius-xenon-ariel-delphinus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e1e4e38e52a8671395f4bc99d4b8fd899597b95008321a521a2a9351afdab05 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in meteor-procyon-cz-conventional-changelog-less (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ce526585f3291027500d8aecca16e3c975f59e540345c857472d2714f6ec636 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in figures-protractor-changelog-fusion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6927adefae2b36f27f179178319310ec17e61ada0fa07dde6c9c2c00d2085a7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in farout-draco-supervisor-chai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4858586155e7e63f2df1e9db1181fe0476633fc8b100b90271961b692e2d9f6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in winston-gatsby-zenobia-eslint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4539e20771a5e14a396382185985a89fdd823182f16cf3fe399f24140d7e8c4f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...