Malicious code in rollup-supervisor-fornax-vortex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a61010f916d4168f9195bd75c485c5d125f4cfa390ab502895dfa7938f1a20b9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sedna-centaurus-algol-ini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d0716f67cbdc69220f2797ddf07dfd1a2d184b4a73e4c7c59e13a256a2af2e3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in version-halley-aurora-terser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 417dbff543afff71c3268a40a187a4b20ad7b377ff7954013aced18878856eac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in winston-loglevel-ariel-cors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8400d28101f9e8945eeecd6bc1b83b5ef1c31064aba6739eb69b2bd2223d4f4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in norma-aether-thuban-triton (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34926fe5717955e2b3719df604136815a0cd579c4e9b0a766baed82f8f5dbccc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fork-carpo-xenos-element-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73d435d055edbf91ca49fedb64f445e1a347374a30a36f392b0215d325440de2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chakra-ui-scripts-procyon-pino-pretty (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector deca403d973cf24a4f66fb36e71f489da94a83ac29e15ce9fae18fc46d6f6811 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sedna-iota-arcturus-google (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f839cfe04ad72874d7b402390537f828a683c05b13808b40b85a5f1c366945c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in commitlint-meteor-centauri-dione (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fa3663d895433f1033c78c51ac79a941109265b8339154bfc256c6dc6d5abfd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in magellan-tool-materialize-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 880c386cf3345ba34aef43fcbad885305ac968c3ade923f78e7cbd093c693f55 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in semantic-release-backend-scripts-publish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe3df3fc402b54693afaf15ba26eee4688a1020285588b66a7cf0e0431a7f767 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nightmare-sagitta-public-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b92c8880fb2cbef96c09b19470435e7b296ca92542ccb4e844977721d142592 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ora-europa-tool-norma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e006f42e194527ca2cc8573e612feb59b34bb39906c9d9544474f1576887f5f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-114358

Malicious code in dotenv-safe-elektra-build-octans npm...

Malicious code in draco-wasat-miranda-node-sass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7854af127c6cde6e23a5aa64329b6e001b5ca79115617c855e6e263daf890134 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in izar-transport-transport-xerxes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 618328e12b0ff637ceb1688683a924234b65fbda44e8fcb3c6a3ad3647166f7e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-112839

Malicious code in hercules-betelgeuse-sedna-izar npm...

EUVD-2025-123378

Malicious code in private-ursa-terser-capella npm...

Malicious code in betelgeuse-node-config-webdriver-mocha-auriga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a6bb0a98922401bd6403c8a219e0615fc5d749430667d02d1d7b9d26dfe6227 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in repository-phoenix-altair-firebase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56358002f8c5f94fc9121e5c7eed6f83e3b6ae720afe694721b04db71840074b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...