MAL-2025-139524 Malicious code in apollo-quasar-hermes-dactyl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 652e2d076c3ee69316f7b51ec59ecd9c44accaccb4af2c046cfab5c66c5133e4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140522 Malicious code in celeste-rocket-nightwatch-xo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd8c1a7ce21f97d1a465c17c98b1da1fb0548bcc5ac605c81f2286030ac4390e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147946 Malicious code in sirius-development-gemini-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e955a5191c86c0569fc6fc59e5066668be1770cfc264f30ce9c384c7aa39560f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142988 Malicious code in got-superagent-passport-chai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0230d14e2b4ea76e2119fa0b86c46d053d908cf42b18a75e56f3b15296d96fc8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142574 Malicious code in forever-release-it-iota-virgo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36ef678b480ea8357c3403bc92974a35f3d3162eb978c30eada96539552e2922 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147411 Malicious code in reveal-md-grus-middleware-polaris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5aeec93a734c0dde2c4d4e430a88ca8320a46fe77ff5af7125db03ad02c7d43 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149590 Malicious code in xanadu-centaurus-scorpius-babel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f3bcd92f5223ed3455308cd868500f9582e6abe1081bf9975ab41468d08a549 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149718 Malicious code in xerxes-sagitta-inquirer-terser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7915274b61f1f22bf6d1e217c5cd0ad40fe1ce4bad4d9789e88d6007dac75532 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145294 Malicious code in native-quito-venus-semantic-release (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22cd3182705b88c0e14381b43792c9118b4bafb5d433ada79eafddb31bd3afa5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139637 Malicious code in async-sedna-prompts-less-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1eb88c2f8971fe4760ed74b9feeaace97081beccb982086fb14a92bb504a614c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140150 Malicious code in buffer-achernar-winston-triton (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a565a391c2111e7bfc57ebe2f777db3411010b05f0da531578022935b325ea29 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145003 Malicious code in mira-aurora-jekyll-radiant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c37198abfa595ebad14a4918dff72d195729333be2f1385ab33554a1a5bbf5d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142481 Malicious code in figures-scorpius-gravity-markdown-pdf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e254e05123db98929538092e918e04c4e597fa8cc159bb076609d7276a8c7fb2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145976 Malicious code in passport-auth-mongoose-phoebe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7d85f744ac10f023e729b0938e368ce262176e72333839512dcd5f6d5f7e510 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in narrow_goose_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e70a40f34ac270e32d345abe4cf6f6faeffad82b24fe6c6f9731a29532fcad56 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vivid_finch_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d702e3993e606ef0aef4050ed75aeca79c7282645c6bb316ac21584d17d13a2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139148 Malicious code in near_owl_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae380128e7d87d2b82ad55d13198e6560306659f85226e358b62b95cecfbad44 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in surviving-moccasin-galliform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f235ba1eab40ba3b200f82833d0ff392c14efe1abb28c0ca1f8c8eb057f3bafa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in smart-tan-jackal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6346393ce37cb8b00d5201fae5e8b195ce2de523c7d24b265a68e3f23021174e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spotty-green-mouse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 235b2d0ae78ab8ad8a86f5f1b00a821d6d7696dfa134f0f972d25217e09c3d52 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...