MAL-2025-141472 Malicious code in dagda-hydra-centaurus-hexo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 605b352e297554fe9236e9e8e02de5c22194bdced5da448b3c8ffe0d6a8e855a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148766 Malicious code in transform-jwt-vulcan-dione (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c80384b9ca3ac80bebc0293067f2180a4cc09a4a9a27fdbc9006815ddc60ae8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142387 Malicious code in express-nconf-husky-mocha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aae9edde299403a6442d6af8b3c21528a87a3db62eee3bbaa3bfdcc5d7ec48f1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in babel-auth0-castor-csrf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d78dda6dd9d98eba1091976353e8dee3850210f8c8f25cfca2de9027e312deda This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146756 Malicious code in public-cors-blitz-loopback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7bcf7e6061cc2031bd3fd0cdac81677b4939a86b79ccdf495329740c6e38724 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143207 Malicious code in heka-lint-pulsar-install (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 483200965e1cb5ec676a4734db1d2ad6b2ce08a2fc3556fbc9e01870f7831de5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148986 Malicious code in unuk-sedna-cross-env-xanadu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f46ecc9ad12a0b9cd7f2d3eb400ba8eea4dd4bf8faeac232d404afb24f07801d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145065 Malicious code in mocha-aldebaran-nashira-node-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1575e1db5935e5a93f31d629ad6daf1a3a9220b1bcba15d162499b8e542dfea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148831 Malicious code in triton-webdriver-mocha-hercules-sails (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c377541408e4dd2d0d9420417ccf43e9296fce7cdfd3020e459e556e4478417 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143580 Malicious code in indus-vuepress-gravity-electron-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 842edb560ff36acfb2b0d37655c806a3ae96deac3576f8748acf76b28820150f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143573 Malicious code in indus-perseus-publish-rate-limiter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a4adc8449cde1c265151055a6b6265cbee2a4f80fae639c8a6e00f6778daecd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143204 Malicious code in heka-exec-terser-webpack-plugin-start (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 459a8911d404ea550d39c9a03962c94d442f59f3731ba158658f93ea0e9d1729 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in europa-elara-ora-antares (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d2429416003a98f5ff4a3134836901c63b440a91cd3ac932abbeb75e3bd0536 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in loop-sadr-mensa-cassini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f37c6d94c5110e973d1ee3f2bb26b12db11bfa2e35bc1e57032de8fadb1cab64 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in command-nebula-cygnus-restart (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e280b5604f2dd401da43328b78c2c409e0edb233c8e0c006f4dbd7dd0870c4b8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hydra-private-quantum-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7752eea6c390ecdad596c26d970535b56ffc581203dd983c86e96c291b7694c1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vulcan-express-phenomic-meteor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90d9c5814154ab32cb6266dfcc631d0eecf3797aee3527044383bd1999e4c9c3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dactyl-native-superagent-nextjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9399d903b38766a58790ac43991a2e3704dcf083ce309f85ffdf08a9046286c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in semantic-ui-tool-fornax-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc452a16821f632b60df56036af5151063884ee1b108f2aa9dafd78573f9d437 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139637 Malicious code in async-sedna-prompts-less-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1eb88c2f8971fe4760ed74b9feeaace97081beccb982086fb14a92bb504a614c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...