MAL-2025-146645 Malicious code in promise-nuxtjs-umbra-express (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d6747916a43b67afac536aee936f618012365ded1a68c4b06f03465d4eca2da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in luna-toml-bunyan-csrf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02fe946e206d502c4d09eed806309f7229c9b311914a265613e10f8166142950 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in adonis-inquirer-webdriver-mocha-publish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b2a926174d560c4a0280fc751da44d37f6595ed4f96e833fa6dd0cc2b1b17d4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in inquirer-rehype-wezen-relay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e55d769614ab0ee9cf3e63d233ac385df04e37a618437fc4209773d35934c5cf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in link-ora-loglevel-andromeda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81750155f6317d515808884158c0219879bb3a01bfd1e4f522848f357c7a422e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in perseus-kronos-figures-commitlint-config-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5eb27018f4f80f4bc6b981bd4783b7165ec1289ff35009e4723281ce7b6b0d97 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in non-blocking-lacerta-halley-dependencies (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5a8fa6827ac9e19e9e0a00af75cdcff500e2b579e6e078c205cf56c3bcbc808 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phenomic-despina-dagda-xenon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab449a137192f276f029ef3c6b3f440fb5830046c09e761a0471ccc9abb43b51 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xenon-optimize-css-assets-webpack-plugin-wezen-betelgeuse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85498b1cfb1363adf7f3f0607af18be5b0295e58123b95537e8af5ec9afe85b6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in slides-inquirer-delphinus-auriga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91f99d7fb9432dd30ab8ca0c7996dc80b6510b5ece02616847e2483aaf06702d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pavo-taurus-miranda-warp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9aac5ead4efc3c11d82c7f4194496e147b4fe85c3b007b970f904232f39c907f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in blitz-supervisor-frontend-bunyan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b2029dfc8b076f14a12671411583cb22e9e6cafc8db1af4921efef284bd2410 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in europa-atlas-despina-comet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5a7d6efd6baeb724020db9807fe266b2a6de8f0b3a65477fcf5f4ec343b8eca This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in winston-pino-pretty-parcel-publish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf34adf731cd0173b3fc913fcac4763e84f4cc5b9fdc9f8f64557546928e3e63 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cache-ophiuchus-nova-atlas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1827e4b1a2cef90d66573f8c0f5a5764e5a0bd9632f912afff6cbc89f26e098 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in unuk-nightwatch-levels-neptune (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88b35f4e13724988b9b8b6e19d6cbd6aa7acf2a8df370570ee8ea0c28c6f065c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in carpo-ganymede-kastra-leda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7afb774a53ba565469f8094ace021d2bfe40abb0b43530b02ab62cd932873e43 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in release-it-nightwatch-jekyll-yildun (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5796729233de51edc8c296497cfcabae7b685d63f4f1c6a8c094d2ab4513ade2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eslint-websockets-standard-enif (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26f9ca9a5cd7e54f60d8828cddc1b5724b64fbd0901163e56ac696fe2cb2ec19 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chalk-kaus-eslint-helios (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4159c0dbbb89b303076efe400413c3f25ca847b455c5b90c4a461c76df3e9ff5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...