MAL-2025-147293 Malicious code in request-event-antares-sqlite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 450c77c16e7214dddfd423894d2688c8084da5ed5cd5285c01ccd574dca75de8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146266 Malicious code in pipe-prettier-stylelint-fomalhaut-telesto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67ac29fca3ac3709645dfc3f811b8445f16d912d8a52b86c2ff781007970a518 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in babel-auth0-castor-csrf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d78dda6dd9d98eba1091976353e8dee3850210f8c8f25cfca2de9027e312deda This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141423 Malicious code in cz-conventional-changelog-kastra-rollup-nightwatch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38e9525cff2d4f497c1e161782ad3e5478832085c188b7182639221632cc9fee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cli-ursa-rigel-dotenv-parse-variables (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2bfccea257902995f50333344f6cadcf7150cfdd31b9f5dc79dc56a4e1d2a22 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rate-limiter-mira-test-figures (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 459e4c2087053867386e2676432667509cc728c02281ab2bf11291ecf3ce2352 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hyperion-hermes-oauth-non-blocking (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ac0492b74e5b2ea4569a72ef3f1cb2e2b3abe987a865f7fb22505c6071ea3ef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in auth0-style-loader-polaris-gridsome (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 017babb992767ee4824521e3abb64ee04ac53ee11d2883e77db12c39112dbb76 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sync-perseus-airbnb-bellatrix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e798a293f82fa6711ebe5fd6e4175f927ff267443149f31e6ad259235274623 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kinetic-mini-css-extract-plugin-winston-spectron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a22880454f6c3b89cc13ee3e15c29aca4689483d59fc2695a5b325d74267ae4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in local-loopback-lynx-titan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 966908cde0064e80dc5fbe3f177c31a09a9571cdb46ee3bd78ed83cee54050d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in javascript-postcss-loader-fornax-ariel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09a46307816ef7e2a4a5c766bce7438cb607b945a2cd4692da71b738b8332511 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wolf-nuxtjs-mira-spica (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be3258b064bb655bb212c29f171951d33033c240d6fe5dd0b0bc92e9898d2678 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sagitta-vuepress-delphinus-init (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41d367d8ce198d4ed18d5ae4e74bd0b2fee094c74ab6e4d57f7c7b2a7582cbbc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rest-eris-norma-rollup-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bbf62dbc0285b74b3bcefcc881a1cd6aae2fdae5f5a5027a8f2028f804ce385 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in avior-semantic-release-prettier-cz-conventional-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad1bee846b0039c60e0e0057b6c29b031b648b21ebbe632243dafe96452cfc5b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in npm-ini-helios-luna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ce669b34e85d458db538df813a9e40ac3efc5db9a1822aba0115e582777b186 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in firebase-meissa-loopback-event (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88272abc19fe27fd8fe14abf6c2687fd476bd7824effb94ab1db41c7704d3038 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in yakutsk-kastra-webpack-release-it (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da31a94dea166f9732544d8bc74d15fb23b8b8d49f3dcd8465de86a7b8ba7022 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in barnard-nebula-altair-gulp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d371224236e78d1bf077551b6a3e5eada33e7a51cafbbfc732804d200f8d6f6a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...