Malicious code in elara-triton-quasar-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc2ebd6f38ab2bc5abd8dd2a5c620057c834fe86a99da5764849ed9c0b4d1e6b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sagitta-antares-winston-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ddd0b309f243a59e5c481a498f75eb1c403e12809499a7c5b5fee2a091da4f0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eris-perseus-subscription-iota (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b261a9fb861a3208da1f028fe4c2ebee2a90df3ce636dcd100ab6c0f0ceb8c2c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-175600

Malicious code in webdriver-mocha-tectonic-leda-antimatter npm...

Malicious code in virtualize-reject-secure-finally-function (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c2d4b6d8c1cf607c34947c1092356b4306699e741e0587ad20bf50524ad08a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cz-conventional-changelog-blitz-steganography-lacerta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 730ff285678049eb66e80db3988bb6718e03f59c281d112d5768eb338419befa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in apollo-slides-duplex-fornax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba8a0f7103bc28344b11048c487f65148e33abee3d3ff35337b6564cbb4ca14a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-175844

Malicious code in ultra-karma-nuxtjs-nanotechnology npm...

Malicious code in java-socket-cluster-decode-catch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91f9d43e44408d07d0519e14906a4ab844a8bbdaef97555ba604ada50af6e13d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in test-slides-bellatrix-io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bba71d4110a671fcb6d0cda97d9dc561e75c7fb386b29b0f7f2867f6d222056b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cassini-halley-jekyll-less (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfd52a72d246c6814a27d6224892b221e16e0799cabb54223fb2bf8d9bc57b74 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in moon-omicron-stub-long-book (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 615d1c6d7ad392f76870b9ba5fe3083a43808be1d4132f9f98bc7b60221d1ebe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-179174

Malicious code in elektra-jekyll-ini-async npm...

Malicious code in duplex-init-parcel-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac497f57073665d298fcc5fecb6ca9e77e45df4bf3dd82e143a292881ec22153 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bootstrap-semantic-release-pulsar-koa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6105ade3946c0a9b9a29cac5be3458e9ab96773616c0e664047e26dcd915a13b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-175588

Malicious code in webpack-dotenv-safe-avior-nodejs npm...

Malicious code in load-fire-balance-try-old (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ed8bd45f714ed76dc28e104d80484f6275477e646f6d793386b90377bb12749 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in neutronstar-quark-dotenv-safe-koa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c51ac63c08154afa26f71278cae2c6f17bf39e6835d2f205cc35e304e1bf2f31 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-178534

Malicious code in hermes-version-mdx-yaml npm...

Malicious code in emulate-sudo-query-balance-air (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40e4eec2a59cbcdf3ec68a88c1b19fbd9aeb9ce1cb89ebba9c49b3ec09e41ac1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...