MAL-2025-144565 Malicious code in loopback-socketio-restart-resolvers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fc135c39dd60c0e9542761abc5a6c9b077de7f18dccf0e15264129c66ebd396 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139645 Malicious code in atlas-inquirer-jabbah-protractor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f663eb7f0ed0ca0461160ef8e2dc4cfcc7b4290eb39109ff4c70676afa0e3212 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139409 Malicious code in antares-forever-eleventy-carpo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1176b13fe05a33c670c5065abbc172457e68eabe3127f0c4345eb74dfe4db208 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140435 Malicious code in carpo-centauri-commitlint-config-angular-callback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47297371af1cf02d6849edb62adb000fcbda44132fb3a3c3954bf6ef90e9675a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144114 Malicious code in karma-pegasus-config-europa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe7dcaac8a0df43e485ca6c5ee3f16edf05faefa4c30aba7801a07fc475e2998 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140601 Malicious code in chai-postgres-spica-odin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86423b10b6f306d99f24e92167c625a39c2149992f37343635ede70b25d42e1c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142528 Malicious code in flare-hermes-halley-despina (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53a824300366c6adf30ce407470de5ed2276e7c9d7c0a119f512c5f3e32a9082 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ultra-sass-loader-pegasus-auriga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4582c937e56d01f391201e9c3ab543d08c5f1fefed78d980ff35171b20714de8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ariel-polaris-rimraf-convict (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7d7e5fe0b742c906a629ff41dcd30079db5c74b5bfaf1475bee365ca52b4acb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in test-schema-dione-leda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3af9e6c2b2b4d710d8a1f6df5d2630dad09faaf289798dc90e320c66da0f8106 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in commitizen-sirius-levels-supervisor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0d4da1d7df5154dbec6dc9e1b5df6c8a185d3ee33fc1050930d94bfe6457cd3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in semantic-release-google-warp-vuetify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector befc3050b341d286101261fec11b2cb358d3994e132344a3ffd96727445879e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-112743

Malicious code in html-webpack-plugin-procyon-airbnb-relay npm...

Malicious code in helmet-blaze-eridanus-galaxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a23f280c4969fd442a925326b4a70a71af391c3ca923f2f2784d2aeaec842b23 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in antd-async-sagitta-mocha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9b06b3318adfe4495009692d720576dccbd81fb74b2e9c690133f67d70fa5ab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in halley-local-airbnb-commitizen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a5f7cfaefcaf380f86b20f812c3d5e97113bcf8ff0e3126e8cde3c38f434c95 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in polaris-despina-galaxy-got (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20baeb4de7139e23de09686c30c274bbcbbd52b6a4b6ceec47ce9c6ac321597c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in polaris-phoebe-spectron-webdriver-enif (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62f2df56849161afef0e61b35720a8f08f6de55bf2423f2fd6a6c56a34555cd9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in publish-ultra-webdriver-manager-leda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector add34f45e373dcd2f575e70cf18bc5a1222ee39cbfbd8e89b52cf8773ad1bf2e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in request-server-ariel-sirius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ab9456315197599ddcea0392f87eea221db5072caa463e66a4a04e562bad81a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...