MAL-2025-147781 Malicious code in sedna-parcel-css-loader-materialize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 890b20fdeac58083ea4dc8ac0159ee633ef660eb39bd5b22367ef4442d9424b4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147015 Malicious code in radiant-local-magellan-dactyl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b008f7cc192e9f504f1506fd14fee85d7b274ba80d2a60521cffc7753559a0dc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149815 Malicious code in yildun-ganymede-puppeteer-sedna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bfc9273c73ca300d2c28e83d74bcd02b2f30785e86e9bda858c5577c482307c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148826 Malicious code in triton-radiant-lynx-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7121cea280f69ec28b05823531126fbded5800410379d2b89f4942fd981ba2c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145999 Malicious code in pavo-hugo-winston-iota (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bfdf061a2794f8911e73a0f36fd0d80603c5fed1800c355ddc0f4ef97e5a82c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143233 Malicious code in helios-grus-morgan-tailwindcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8cf6eb17521dfa305a33e0990d686800f538681feeae23d261273fa6889f5f3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143037 Malicious code in gridsome-dependencies-hugo-ganymede (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34cb118dfb512914757607f2581b601773b46370aa44eedf0fd97b506eeb430c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147908 Malicious code in shelljs-ariel-ophiuchus-sails (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 693053840c257ad600fff44f093b29ccfea20e6067e1597aaf6f8e47ebdb03ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149659 Malicious code in xenon-repository-radiant-configstore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d46799f01c1add7c954c79d53f8c463356b37c7c7e01ecf694e3104e98508858 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148127 Malicious code in spectron-webdriver-bootstrap-auth0-sadr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c4dc39f57448875b8be8f6d2e20c57fea021b4e88fcacced609ad7670a9dbd0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148456 Malicious code in tailwindcss-style-loader-corvus-mensa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 360dda3cbdf0ad64d11cf806ebe3a954d387a100ad64aff35dfb9ca17fcb04b1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142623 Malicious code in fornax-gulp-cross-env-miranda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0116f63d9e00fd8d009e592db933a26fd7559ef2ec9933865bcdcc325f20b70b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142565 Malicious code in forever-configstore-markdownlint-webdriver-mocha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce9deb2f56cf0ee4b3e376a18166ca56a9018309a961160ec32f622f8bc6b661 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140156 Malicious code in buffer-cypress-auth0-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b0c18409218143999f63d9b4bb00c9a7582921a01c8ab912420d733ad20687d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tethys-non-blocking-hexo-spinner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d885f6678a047d144fa23ca12189e3691db1ed724e104927120acef8a43c47e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in socketio-rollup-plugin-vuetify-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b25cfe748bbdae6caba66a493bc7b808107e36ada1c4f2a6279623281fcff361 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-120818

Malicious code in venus-express-lynx-writable npm...

Malicious code in quasar-firebase-fornax-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c2cbf84fe96d40effc4d6859f430e71ef58609ebb50c5eac96bc704a23190e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rocket-phoebe-phoebe-perseus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2abb6f55dac5ef11374f9fa96c5771d9ecc7f08d9a77248e89188838c71138a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wasat-andromeda-phoebe-child-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06d09196c4b90b3a84cf7add48bfe8e3cb2279e49e087e3e677594151a90cf41 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...