MAL-2025-110174 Malicious code in unpleasant_leech-strongdev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9a58e14a54043da48538a957b34d7f18e69301a32f7997e0792706aad946efc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-107077 Malicious code in pierogi-notthedevs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af97585b8dddecd94a7acad910994528de5eb462e213726d68e1a311255cff2e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-100729 Malicious code in communist_snipe-appteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2df43668df009ba4eb078cd253e4ec5eefd27e8449b9f347c8e4eb39caf9bd4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-102407 Malicious code in extended_albatross-smiletea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 330d4e61fd19e249297d261057d3b6374aed4612e712b71246dd03dfe1cb8297 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-102889 Malicious code in fragile_beetle-appteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce1e6ca3789f3fa915453837ed665e3c6f71ebf9e38bcf9f9e3549ba156fda34 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-108647 Malicious code in shrimp-notthedevs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d6c98ae211f12ae7a2cd20cc1f19beabeb56f103922381b3890195f197e7dce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-108683 Malicious code in silky_hornet-appteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34dcbeb877380ed4543194354a106afaeab8f4016557ad7d4927fe238b30e785 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-100014 Malicious code in blonde_bat-toolteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4372ff1f3ac79b60fa49ea5d5eb9273c2a875f3c937dc0868254353850354122 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-108230 Malicious code in rubber_hummingbird-silentdev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b020eb8d0af2775ea48b8de006f268535de12d86a8a3a55c5744e908050f33d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-100393 Malicious code in chosen_orangutan-excellentdev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76114e5be17a81cd5e389245a248d6144fb69ab371d0173aa91cdbe956855d07 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-75052

Malicious code in aggregatebug-appteadev npm...

Malicious code in attractive_silverfish-appteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f93a672045fca0b1b5dc3e340f4a19698940f56cb3cc1baf385909be1aa7339b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in integrated_anteater-apptea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 669ace49f64a85498c4f5fc038dc4019080372da38a96fad7b8bac2e6a26c490 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in formidable_asp-appteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c07a5c802b0e90ea7778c3f11c96a063572025395058a4f6e29ce52bf2dd5631 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sdsowf-devapptea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c52b61ff263b80c858b81a473d25ed3f0d9683252181def915c1f702bd98f124 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-76612

Malicious code in iixalim-notthedevs npm...

Malicious code in obvious_tuna-appteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c08505bd80ba96bea4a0205344f2066291fc4cb13f261b97089abf3d7abdbdc1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in awkward_nightingale-notthedev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce4bdf3173bff7242928e9f93ed65d8be23d532e436bee4b3ae7aa2eff99033d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rational_tortoise-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95f5c134fc3e354d137d2cc98276e12e1e0c5547c5a97f6fda5b99335db37a51 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in huethea-notthedevs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e2cb3fede06ad21fa6f889823e8628134c66e3c151e8939679331f76c0ab972 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...