MAL-2025-147243 Malicious code in remark-castor-ophiuchus-lynx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9974665bae787c95a53b225627dbad7b63f5036dde9ea0330b70f1b73b5aa9b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139995 Malicious code in betelgeuse-octans-venus-miranda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33571f015c46e84fa6fba8638064826f599bbdff229f5ad4a15ad7405eddb455 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146872 Malicious code in pyxis-config-eslint-plugin-exec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9039999becb8512da6baec8c9a9785c430ce5c276938dacaed4906dcbcde51d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141772 Malicious code in dotenv-safe-protractor-bellatrix-janus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8193c16d4b5afbfe238ebe608716ba96c5fff7255b801cd103a6d0ee39f61375 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in callisto-cygnus-supervisor-blitz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b7899891f8cc925ee20ff0796029e82e650d8e993a8700427c6e262950b1045 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in duplex-galaxy-postgres-bellatrix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e258dc5e9b5fb277fc19f420f2898fcc42e171ed175cd5bb214e6b80bea57e01 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in antares-csrf-ignite-bunyan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acfd3b91a49b333d4e3b551e825ad73ebabb48af5696ee496404e652d6a1ee9d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bootes-betelgeuse-forever-xml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f642659a1b6ce09ff66cc79760e53f20dc42e315da65407b73126e5b9842d69b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nconf-backend-comet-phoenix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9af761dc5140f525098aed3c47cc1d795a86700f2c528c418a56ec570d847fac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lyra-hapi-airbnb-protractor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c65055bd97dcce6cc8bccd65bf096b6499772061ed4af24b831f79df372a16f1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in writable-umbriel-betelgeuse-altair (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49aed667d56d8cc8885f4af0fcabcf078c4098c9b6ba017f25d958cddd56a802 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in schema-csv-octans-eslint-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c3ff1d427c6dc5249ebd942a1b207b0ea02860a4d1ee16fa12badf4b8206eae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cassini-repository-miranda-nightmare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9994289f1b06224486a425bfaa67a7547e6b44511dfb090b75b18603974c835 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wezen-airbnb-apollo-nuxtjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 497b37af348964b032eddc3ce59b194d73d50bcef3f435254bfc827f0218a106 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jasmine-pegasus-ganymede-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8806337254abbb601db4f0aeea920ca50a9164692f6a8295b7ff69ca6582132c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in element-ui-aquarius-pulsar-readable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e148e048a9d6ea1ef88407cb658357a67af0a8b1c711b2bd44299f67bf0772f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ignite-cassini-polaris-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2ff216c374d413615fb651d407bd4c6cd67c42802a074e4c3d7da1df51cd208 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in galaxy-gulp-socketio-solis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a5145d9682743031b8b7616fe119454d6603e023db328a3b4a5a52e7f22c0a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in forever-bootes-betelgeuse-bunyan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b326cf2963fd88f54d0edcdd72259d0a59da79d16ffd8a166b7b5e4fd4fa3c0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in auth0-bellatrix-orbit-eris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector beed952ff5c447276e9850d9f01f562419a7b51dff21a62f1a8668d20d516965 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...