MAL-2025-144608 Malicious code in lyra-grus-csv-dotenv-parse-variables (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e23074145049a720e304aacae238b9e6e91e6e85a207ebbd06a7a074a4f7fa95 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148023 Malicious code in soap-hyperion-juno-mysql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cbf8b288371f848df71ed44fa48d183d53ae0aee3876e71ff53088e635592f3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cygnus-karma-prettier-plugin-markdown-winston (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a6faf87213f3896d4b91f618bac8a5f8c5bd2a42cc97da78fe28bb81fa36027 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in react-bootstrap-perseus-loop-octans (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61172e3c6854cb76a038cf824b66df090e14de7ea249bac4f0599eb783a7758e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in apex-dotenv-parse-variables-wezen-ora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a9fd5bae6492801246b032822f7b75cfe47a3a5483a7f98fc995f172a9eb619 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142084 Malicious code in envconfig-pulsar-ganymede-norma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9d273af31417a606c7ba3620cffa410dc76bc49ce822f63c70b2ea7760ad981 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in reveal-md-ganymede-chromedriver-dotenv-parse-variables (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05bf8e69492fcec22cba663947e29cb7dbc03cf4ad877ee0b9b0db4d8dac3f82 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140559 Malicious code in ceres-configstore-jwt-chalk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49b37125288f59175aae4e6dc61e0ccea7b4160d5711e3420d95b347159ba37f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in postcss-loader-telesto-vulcan-phenomic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2d032771765afdffab124f10a56de31b135824b7fdd9e795e2ba150faca6d14 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in frontend-pulsar-nuxtjs-request (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6273018e032c98dfefa980044a8e70889caebc56332360a580aac8f43fcb2ce5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in oauth-nextjs-winston-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f33e356c375a07eb1114356bc140ade2d78b93ddd6e18f333b96d5d5ba5afee0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144988 Malicious code in mini-css-extract-plugin-postcss-hapi-protractor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01be8cfa96e4044e64f8c668c0d1417368b0897ee88586a73bd7dd7c873c629d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phoebe-metalsmith-antares-cluster (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fca16066e644ed44cdfacbc49e496fdaf106242a6c75d6fa7eb39de9968b719 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in grunt-quito-postcss-loader-koa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d826d965e9cc8b660a3f05be49a7e3a2285006bc084e6fdd7c51e38c1d14db96 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in magellan-astro-taurus-slides (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cf0ce6cfcc1944002839109c84e81c317bf8ee3ead756f370ece942286982dd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in meteor-start-query-cressida (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbc490646055a04b32e6ac80c29731adb0ffe77135199dacd712a2f500f6711d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in typeorm-fornax-centaurus-eridanus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f30755572e37c868fe80982adf7e0e1b3a3c84d267e86cf691003fcaaba7c0a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eslint-carina-forever-hermes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7f91ef5dc4c00f9832c98df57115357c304787af3987b4df8eb1f049d795218 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prompts-ophiuchus-indus-ignite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3d007e985a3247da7668e6a5323b5a2600c9ea75aa3ab5f68e692cace8f43da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in achernar-eris-halley-wolf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb67b048a0c6e8814eae9316db3934da6078e2a0cd2b8227ba096492e3f4d96d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...