MAL-2025-146298 Malicious code in pm2-grus-castor-hermes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b01596d797dab056c781ca726c1f03fc07bec0ea69821410f74259d0a63bcf5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nadia-sate72-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88682ccc2a1c1f7d76276edeb8462baaa54d0ca956b68518ad952dca33086f61 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-127939 Malicious code in kresna-enting53-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 843b56b025b69a0a70e42605ff9a63bc1478139f460e808e89babe67102c5513 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-106407 Malicious code in nuclear_whale_0xrequest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1abf6bd5581955d17cbc4435391fa417a287a3f7c36510772c3980d7d87de5fb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in neighbouring_trout_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6abfac8f18b718e1aa1ba5bfb706a8d545aa475e2ff97a70054d2da61dd1fa2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-52842 Malicious code in hadianto-lupis51-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03dc37a9caf45b5ce49c922c792c917e12854eee4a8f3330bfc53406c326cb94 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...