MAL-2025-139945 Malicious code in bellatrix-nextjs-jupiter-dagda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1de40fab1d77b3995ee4b7c22866b53c55a021ce44aab33a3bff0ed6b29d6d9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in venus-orbit-husky-morgan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af0539518de3e6cccfcabe6c6b3e4c46ffa3507a82cd794c94d97994c8506e73 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in got-terser-webpack-plugin-ursa-wolf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 058ff3c61f26380211cb6100a4dadc0e5377421f361087f0ef9fc8e44f437fa9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in commitizen-rimraf-figures-phoebe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66aae2714021dd118c8ba366f6b6870e5c1419b5ba2ac2523986e777b5c22445 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in buffer-soap-vortex-mini-css-extract-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 385e2601e243ff5a96bff2b732ca8a19c8db68b7250400cae9ff4e8e70bb5f36 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in despina-octans-metalsmith-html-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9384bbb9fc0aa0e1f16a71cc9464392c53182e411ef298e21246033a29d53347 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ariel-ursa-nodemon-rate-limiter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33c8ef633f483964dc26c0274ee176e28dfbf8faf7ca47094bdec593aed66d4c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wolf-jabbah-axios-proxima (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb514dc69b97db26c0206a29a61c0a101baaab726b1e5cb364a3d76a6c7a51de This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in npm-cressida-antares-sagitta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d9e077222905d8156a630abb6c49f2ebdaa023e818242f76ceac1de7292a6eb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-safe-kronos-aurora-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02998f5866080f53cd6472b39a98ec84ad72333e9427068bd1785888188c3216 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in norma-fusion-corvus-postcss-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69ca828881dbff58f18a3c8203b8840ef7d72a798a101a9ae7b5d77c4a3f5ade This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in shelljs-prompts-meteor-pavo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dab93fab7c2840eeb9d78277dc25dc871270bad87bf27cccf35509e1ccf9628 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-safe-parcel-convict-umbriel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3887411420b633571876d73bdc8d64a712e76bcccdfd293ea444bddc36a38c3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in style-loader-mocha-hermes-selenium (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07102cd37703dd714aaeabd074e6aa1065968ad2251dc5f76e87ccc719794db5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in axios-exec-umbriel-meteor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f961ce0c9fcf488462a54c9cff34ad6de5a026e596e381a681ffa5e5c0620582 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in enceladus-gemini-xml-sails (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33afff028fbff8c3f87b0f9a396f96b1919f6780386b7fef8851a69e238f14fa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in helios-acamar-cypress-phoenix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9574053cd71576ee0f80d65ab6fd694f6fcf07821d3526d0442742f118fc9909 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in altair-umbriel-child-process-cross-env (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56c96004ef35148074e4c1f1adf0efbb7176c7ef4fb1b958d124c0ae97eb3479 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jsonp-configstore-janus-semantic-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6491a1ad6532064b4525dda0546ca266738df9e868bb54a32043160081b02742 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wasat-celeste-jasmine-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a87533a11e987b5f26a7ade14149ad1512080f19238fd182c99df99b246cb60 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...