MAL-2025-153653 Malicious code in banuni-otaima-ufua (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56ca0c63aba15c7652ed71423d4dfa78d22fd03900cb5e2030f2248e37c360d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in uaragia-mudahi-syuf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a49c363aef4efc43e4f5a8df560a8a9ebeeeb0bd286245cccbbb9a9da98efd9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in muny-boph-sadaf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80843aac9e7c027e65d15b2b8ca7e2a63efc32a6d063601c10fdf57bd7740a07 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-152957 Malicious code in astia-alabokio-moikaif (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2d308aa2f67c9baf0c60728f369b77d4d3bdb03734e61e4504de19438397747 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-164271 Malicious code in piluvaka-kaiuablbu-nunubai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e18700f1db2e3534b2be7afbb74913753f127f553c4ef772e0dac7208a464339 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-170228 Malicious code in uyifa-iaydut-daina (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e437da5295e91300b0f084b7e78b334dc3d20ca6816b0f51adc4550d80ddc8b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in forever-fornax-nuxtjs-europa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3541086eebbe70f6232c01542c1c747f33ef2d0a56945e336d6ea43c232df603 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145124 Malicious code in mongodb-cz-conventional-changelog-ora-tethys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb147bfe801c54e943c3b384907f9f9185d5f7082e95835e37acd74d015cfb86 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143329 Malicious code in hermes-superagent-google-koa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 839f7222c322fbdf927457e0e47acfabbdf8739f68a3152c7bc8f9f55b0b19a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146268 Malicious code in pipe-rehype-browserify-express (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d69b84626d618a7dcbb56919d1de00304d16f4b5a4aa87afe877e114e520c26 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-121572

Malicious code in subscription-delphinus-grunt-nightwatch npm...

Malicious code in rocket-eclipse-stop-procyon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4def9ff97a89fd4b0585a7027ccf43a81f2a3715dbcea1118fc5360345d78d2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in callisto-jsonp-avior-comet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 908f11f5f4c7839935f96d8f7d7c73ab4922cf0177174f9d9d4877093b50f428 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-121262

Malicious code in thuban-sails-vuetify-nova npm...

MAL-2025-147369 Malicious code in rest-ursa-chalk-rimraf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffa48b21337ae065011cc4a71ebeee38451dbc5d83d5039acf8de668c616f84f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pino-achernar-helios-perseus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a78d836027b3386068716b796b3c8b1931f3c424a999bb8ecb693401a1ff21f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-122301

Malicious code in sagitta-standard-corvus-slides npm...

Malicious code in neptune-version-eris-kronos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d0d74d8bf9d662ccbb903d0bbf47640da6df42e2465abce2007ff3446c08fd9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142502 Malicious code in firebase-materialize-morgan-titan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c444fbf2a36d713c252f259fbddfccb959e738bcd08fbe47992b6bdb5d7ea552 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138921 Malicious code in overwhelming-lime-spider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9a0d2ce3084630b8aaaaa2ccee23d64366e300c6bde289088f5d116c6e2e395 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...