MAL-2025-139908 Malicious code in barnard-hyperion-warp-dagda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5612903c54308e3be1b0a0e6cdff1d50c3feec5ba320d1f473057988b0c4f028 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in equinox-kronos-kinetic-dactyl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 831a60a684a5c73cb17312e4f5ed88d21f0bdc5e97565bd0f3ecc1c9a882d908 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eslint-cluster-cypress-sedna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 637d53ea4287f7af8a63ec76245b34257bda9841fb3c7c973f50572c1f7328c6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149384 Malicious code in webdriverio-supervisor-ignite-puppeteer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6424a19d1f6e46b75ee33765eb3e2b1b1e49ba83db401debdff270e51bb9ccdd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jovian-deneb-global-json (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fc45d25dff6428f6f80adce429bef51b48997924c82d3651d87cfbcf804143a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145161 Malicious code in mongoose-nextjs-tailwindcss-xml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df5baef566e823735372d309ad6675fcc3d0de68e618834cdc3931e40cf8d36b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145374 Malicious code in neptune-playwright-spinner-charon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e30008cb9e1f21683b9946f38ffa4bc9468b704c557c9bb1f67f7f9ad448b2fc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kinetic-restart-json-meissa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d41280a8da14a322823f97291d98aaad9f3017b4f30f284c3144484b75a1fbec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in electron-builder-gridsome-callback-aldebaran (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d649fb3727c16290ecd60b5cbbaca8040d62a9ceac4ce113ad39d98f13ab77b1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in epimetheus-triton-lacerta-altair (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c84f81d63b2a3391cebfaf4fdbf55f15d5cb41615b2987e447e4980502d4c8f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jovian-proxima-dotenv-ariel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6733db5f8deed25a8509ca2236434c17eb704c35183af720bcaca605fcabeb4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in toml-hyperion-meissa-kinetic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c2f18b7a7dd6a2b41c7c3ab074d80a3cb83d5aefed647bd05a8a3ab4c1dddf6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in impulse-dorado-despina-celeste (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39cefd70daa57b4e055538e0ce816ca1bb2a0bec9c6dbc3e086630de381272fd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prettier-stylelint-webdriverio-xerxes-nightwatch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a46c7044db02697faa91ea47e9e00a9fe04e7e7215ebd93e223558d8c16fd72e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in weywot-less-loader-grunt-gatsby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9cb982d6776874e40aa7709ce42d3645a50c6612d45d9a0a2c46a365ca6620f3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sass-loader-cassini-socketio-wasat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39ab95f0501dc0a030fc5556c18a95ff3c795c37a88420e23f40f0791373f795 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in socketio-less-pino-promise (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5142e8f25eb8cb84522138e3c98a5822cfca19eed6ff6a0b8f0608fa00c1687 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in draco-tailwindcss-helmet-yakutsk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c8d7941f34ed14c6cb23f0f0ec0dec198e240f770b1788b17d88201f1fb16b5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in yonder-apollo-ophiuchus-titan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1ff70c563ede2b3fc94cde3fa8f010d80a9e52337867ac9a8c2b2a2e78ce96d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in babel-phoebe-browserify-prompts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0f44dda16e664090c6c0861639697f15699480945501dca4cf1b21e5a6af1d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...