MAL-2025-145128 Malicious code in mongodb-graphql-atlas-tailwindcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cacd7e63f1a9f0ab9a4f16944690ed708c301da57c2b5e5b4d8ea0bea964a8b8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139495 Malicious code in apollo-backend-callback-cordelia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b029e2ff0253adb366a1851b7917fab7d2ea68fc0c4fcdae60e82ac11e422ff2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142525 Malicious code in flare-gridsome-sirius-ini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27d4b1fe500ee2effe967bf7ba30e6d290cc8f00e8f726d25fa86929dd3669d1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140678 Malicious code in changelog-prompts-perseus-phenomic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c91b5099c9a1d521dca15770fbe00e3e4b5209350710e6d696c2a710094e4a8a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149381 Malicious code in webdriverio-relay-update-deneb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb35cd4a8696fdf25e749474ec557164531cbf2d0d80b09118786fac9cb70fa1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dependencies-neptune-update-supervisor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 397b34418700a7519cb7464e8e06f7903ea7fc035617ff240992e51e6953896e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chakra-ui-gravity-mini-css-extract-plugin-chromedriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7d0b71d1eacddb260155bb4fac850e0b16be612054cb740d5d819377a0662bb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149755 Malicious code in xo-repository-package-europa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a1c1b4e798413ed67d60bf079bd9e72384081d946926bf9522d774979b4dc0e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jabbah-stop-fork-andromeda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb8f85fd8655a595a472edf9de22c502004bf3992a2e1d4e481ca097860e48ca This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in query-morgan-thuban-vega (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ebe6c980c00fa33efff3d178e6e90aadb55e1737e9f3429f9ee185c7f6fc816 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in procyon-hapi-csv-flare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c05bafde1be0d3c7cd14dc9a7063a15613942905627ffbbd560696a78aef88c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mira-cz-conventional-changelog-iota-webdriver-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 055ec0f2807c9f58b686c8b3747d316d6d0ca5fb31a450e20d2d6a57d9b1d63a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in exec-materialize-airbnb-dagda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af0208a7ee583a82efbb929eda3527ff3d2c1490269100763d9d56c6843eba40 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in capella-wolf-testcafe-epimetheus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 295c79a4035522fd16a4d1ae5bc9c674fe03ec774676b7dce77dfea5c68238c6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in winston-wasat-gacrux-non-blocking (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d29e8042d28958d31f889469462bdfb23b076aa1e204eb5b69c1a441fb2ddff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eleventy-kastra-cli-sedna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0d2738c6701f3cf8f2dc39e73ecedc3b6742f1a59ce0ba3a0544ada76ab6eb2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in install-writable-centaurus-wolf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a0fb20b45393ae19d09faa8fd150736c08bd5b332a3a9fa59cbd20bc139c656 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pipe-query-puppeteer-postcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 217327ddb3a81eb68c11448bac7cc579de2bd37f7d5a20bcf44b6411817105e2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141595 Malicious code in despina-express-indus-typeorm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 169d8507322147c12e5ffd5c35633e28f481a208635b780d832dbaf2ed12dfd3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spica-css-loader-testcafe-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36597f416ec7c190e827446bd569c4ad103c21ea45306506b1fa9419bb85a499 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...