MAL-2025-146869 Malicious code in puppeteer-xenon-style-loader-xml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18b56d70ad52ccda6fd5988d383f8a86e3e219253eb55ac0bbc9f6a1c69a368d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144334 Malicious code in less-loader-terser-umbra-regulus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2e0130e99b103ea34fd14f21dae9f7697b1ec917b81b17040f86befcb6a844b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141812 Malicious code in duplex-jekyll-janus-postcss-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e5d9eef64606b70b321ce6c4a064af57dcc5d305c662934213156fc9a822c73 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140935 Malicious code in commitizen-less-loader-mysql-html-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1b0ecbb57fc6d6f24d993aca7226c40313a8afa4b924e0eff9c1058e3b64581 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144335 Malicious code in less-loader-toml-private-soap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 497b8201962b4d3aea7518648553d817621cb4351fa1743b801b30d6659b7352 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144409 Malicious code in link-gravity-css-loader-arcturus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a75f70a93f2d197cb9e483e0fb1bcad8f2a0bcddcb8ff63508f3e3bd5dd087ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139577 Malicious code in arcturus-toml-carpo-postcss-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8147de9a6ba9892bbef8fb92f6494108d9eeabd8b916bf2676a4467a322ec14 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144661 Malicious code in magellan-sass-loader-hermes-vortex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d16ff68d2dd7d1053bfa0409aff19e8eb4c277ed562bd9d6407f30d9ed4757ac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139588 Malicious code in ariel-ganymede-octans-postcss-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fec6e1b31aae085b602d14429f3b3df2a9d0004263e668bbc299a4e698d2144 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146402 Malicious code in postcss-loader-nightwatch-hugo-tethys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50e4beacd28628662157313c1228b2e5d2f837b744c07aa98fb2107f178cad4f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149536 Malicious code in winston-yildun-less-loader-dactyl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a69a769cca21c2b2a2a822e2da066c9daed6de27648e615f57d6c614b2376b8a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146184 Malicious code in phoebe-style-loader-cli-jupiter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93e04ce2c712bbc25c67643867a15140421117b4114f9341aa70a921105a3617 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-111508

Malicious code in lyra-eleventy-phenomic-css-loader npm...

Malicious code in triton-scripts-cygnus-css-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2fc611d6b7568136f908c9acb21ec7354043b45aff46b45717181224ee13010 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-124854

Malicious code in miranda-yonder-css-loader-hercules npm...

Malicious code in postcss-loader-style-loader-foundation-ariel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a7af3a5be712e0cae8587eeca54d8551aab41011790b2cadb628fd9c4e66952 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in event-style-loader-quasar-materialize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f3f6d6b77dc2f520cdb7ba4f987505cb6723918edc979b94239282bd9a3e49a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-121086

Malicious code in typeorm-css-loader-draco-docusaurus npm...

EUVD-2025-122142

Malicious code in sedna-parcel-css-loader-materialize npm...

MAL-2025-146404 Malicious code in postcss-loader-oauth-chai-miranda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c48c54ba2e46e0cf1db9575bf6d04ad71d5e2ff725f1353c8b6b9d03cdf82fcc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...