MAL-2025-147338 Malicious code in rest-altair-csrf-arcturus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10d12f9c3117cd64df99f3421c074d81f3494830740d567162b1decb6a9b9850 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149755 Malicious code in xo-repository-package-europa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a1c1b4e798413ed67d60bf079bd9e72384081d946926bf9522d774979b4dc0e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145128 Malicious code in mongodb-graphql-atlas-tailwindcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cacd7e63f1a9f0ab9a4f16944690ed708c301da57c2b5e5b4d8ea0bea964a8b8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in halley-superagent-hydra-sqlite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4642c3f8ab7d248da3daac08d7f2f06935af9afa6a749306e9b8fa8707d54c38 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in event-repository-cordelia-phoebe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6ca10128ca1c595bbe11962c6144feccdb2b3ab4f06fec3de750790066d5095 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-safe-gemini-spica-materialize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d90a21326b456e45374854954b0fa67cbaa4f70120bb594b30d8ad762c87e9a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rigel-spectron-webdriver-dotenv-commitlint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ac6d525170b55a178d5be03793420354ed5b67b0d55cb5e8b560bba82486569 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sails-dependencies-metalsmith-equinox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae30710522f13143fd61006a6137f7c9f1b8a00a51f277fb5f02534ce8037f01 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in development-slidev-dotenv-parse-variables-sedna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e91385d709f1ebeb5eb823a58d2c7ac5ea313806b2484573755491b88a2892c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in envconfig-oberon-pegasus-writable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ef64ff1bc722482830eba161032dd8841a2c241cdc58316dee04dd4f0048768 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in materialize-puppeteer-wasat-slides (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43a563a4ebbc263d311bbc1282a62b76d3289a89eea661bf5c04aa50829af776 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in iota-bellatrix-husky-passport (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2973f9118f939e46c373ee35b5c10d61a18a3c353d952bce4928a4ce858d4aa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in standard-electron-algol-ursa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aefdcbff234b32eaa809ef06910becc75ac6bd245a7a811a8ceb9c68df4b7ddb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eleventy-sails-inquirer-javascript (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8f749a1a37d1634292491cb74be61f5db279766a342da292ba9dd32fabf4394 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in enceladus-process-sqlite-google (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd9273611d6fcd1c1d08fe8e868a72e5bb8227c46876500e01a1ec3d3839c7ad This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in restart-mui-nashira-playwright (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cfbe44374806e35c00fedff0ebd9b6fc637bf9c75b8e9ac317ad72610784140 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pegasus-morgan-polaris-cordelia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37ca8a23e8d2cec9a4cf37fc974af0d4e84bfc6df5c1adc870b4fda3cc145cfe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in node-sass-process-wolf-init (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5009110c757b0598a61838ec0b3547d6aecab8a31eefd10856eb59291fa0ccda This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spinner-fornax-hermes-karma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b265e9ad5f9ea6dabc908ba5c24fc2c13406807bc482c0e554c5a2e780537e3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fomalhaut-lint-kastra-gacrux (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa350b2d4c3c265a386f4cd6b20c20ca0c9bee2e2e106102119c79f0b582dcb4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...