MAL-2025-144393 Malicious code in library-zenobia-native-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce9620d5a9059a59c24af888f0c640dcbdd31ad3e5c571b59e3b1c48a9264c8e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in non-blocking-magellan-carpo-aldebaran (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3558b6b1a1972905e34cd4e0a792d129eaf18c22c5621bafbe2d68de82f493b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in postgres-geckodriver-less-loader-quark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8e7ffe9e4024063c41783a941e17513fc2266685fa86e77704cddf053a63167 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in apollo-bulma-polaris-inquirer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 692d8948eee5220a89db98305c0c5b8563d44e1e8f148eb621bcc3b1f6e1b915 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in auth-tethys-duplex-selenium (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5118548c8190c3f375c9f5128d029bf31797ee6cf9feddc4180b3f4efd440584 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in deimos-gravity-cache-elektra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 622702e688f2fb8e40276dc4b844a58c5ad13b3b4ca30106511cad457fa7130d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in flare-materialize-passport-nightwatch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8aeeb3fbaf0c957bd1d21f84c3b5bfbf60932f1fac91db9365ea346a9b6dad2d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gatsby-betelgeuse-exec-halley (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc2154045e7fb54a083b9029a1dbd9999c466e2d28e5a016fdea509f93c03163 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jwt-element-ui-jekyll-style-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8437bf4f418fb44e983d5e9aee58d0bb513d11557003ae832a6b0eeeaabaf637 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in leda-jabbah-google-rigel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ca5d69cde5ef8f2e71faae2ebf02639ed7e17058b5e0d56f3a0b45189637526 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in markdown-pdf-wasat-luna-browserify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fecd59731081ac14a1d7e6bf85ea26c4a0b8aca42f3e976b461463c99dc87512 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in middleware-postcss-loader-vulcan-configstore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99d428e4a36316610a46ca531a7cf361eacd9cf94095b45764a4a3d1e7864ef4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mysql-websockets-webdriverio-loglevel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 494bff2878a97456ebcc90ae6974ee2cd47cc9a3e8e24390be57fc6741f9763e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in polaris-shelljs-jekyll-sails (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de091a3968f27ce74c81fbe514c2fa98c46ffdd8b63a1a10948c72140895732c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in process-shelljs-neptune-taurus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c3fe6a11e5cb3ab57307b32ce46776f213d03f1af3f4ec2d7a384706424c52b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sails-dependencies-metalsmith-equinox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae30710522f13143fd61006a6137f7c9f1b8a00a51f277fb5f02534ce8037f01 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in start-chromedriver-rehype-event (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa06272d3b898195ececb72f425e69fabf48ad1d4613749198a43e9d6738efeb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in webdriver-manager-io-betelgeuse-cordelia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53b7ad259d79486b5eec821e49788722b5bff497f8471dc329e58af138fda0d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in publish-sails-yildun-sagitta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4131be577a8fccfe05f69672359fd356876315139acb90829a87d84b5ab89f6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in firebase-relay-winston-webdriverio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a8df2c7171ca9261aad999cabc9cab7d7e3eb476ecbee2445af9054a0299af5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...