Malicious code in async-oberon-framework-ursa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5717df4094340a3b32dc4b99bc68bf22c3d181bc748aa862add6b2fd0f2165f0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in init-solis-gravity-proxima (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dce95d071c98aca7f71a3d08c4ff496456f80f37ec606612dbba7ad6d14bf5be This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prompts-zenobia-promise-stream (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2597941e827037dc95c37d6ce60f562a41e408f869d847205cfe66fc276023d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in venus-hermes-lacerta-ceres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79996a3e99ecc6f49fcc9fe9b797330b934a6a4067b96327cd37fb554aefc4a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dynamo-betelgeuse-chromedriver-buffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 785b2087930ad8e2ee5993e91cbb9bba94acf15a486098752d583811cb48e951 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in equinox-xerxes-convict-ignite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc8a218e391950bb7e213b36959360050fc42140f58484814757055dd9ca5a3a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in algol-telesto-apex-chariklo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 425b83e13d92f3becda19f44cce35a2acd7176f48142e6269f60842582d3f0da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rigel-lint-orbit-spica (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e38cdb45ce2c006f7a290eeaa9ebd89179a65844456fe247adb34b597f3473af This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zephyr-npm-farout-izar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f1ada7f740daf4ec82a6105cd6b46ced4f8385c45a41d911c90df80cba58d39 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pegasus-spectron-jupiter-winston (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91bfa4b5df1c46dd1bfc2e3815bfe4db8d08c1fe68806f1e59c00c752993757a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in loglevel-ini-puppeteer-lyra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d86d35a713bef02da5c1926e23331bb6bc7c3f7fc1af3b86a3504773d862e7d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in neptune-stream-toml-postcss-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6ecdbed3d1f61979e80b7310790181fbfae8d2f3d11f3eea7493acce573c6e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in geckodriver-miranda-development-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cd5b8f4b034d6769a2c809520c6cbc938c518d6dda7799b7a6b0eaa61476e78 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hapi-commitizen-update-semantic-release (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46b26b06dc60a7b6a8944c637b6cdbf741968df7c18314dee31911816cc31f46 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in link-await-hydra-bellatrix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e220cc1a4907d0adb9c57a3c648f2f94a2bd56c3c791b05377f7ea379437add This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in less-non-blocking-run-script-xanthus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df8eb2c157e35b8e588e935fc40fe578116e2c12180c063d5ec26c9550c7c6ab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in firebase-webpack-semantic-release-pegasus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b30c4a5f5b373e1253fbc5568dde92c8b9d95968be5db1fc0c7cd27e209803af This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hermes-rehype-writable-eleventy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fa3c685d0bd0edf1a3cd5b9568d2d94ca38c3a9e71d7542e1b5e0808955f95f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hugo-transport-node-config-hermes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae9423feda132f6fc399753b25257e55a7b21305d3123c15d455b262af1712ba This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149374 Malicious code in webdriverio-link-pino-pretty-got (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fa79428782cb74d0590db651ef2f95b2ab2a1a1efad5f7d841d627547af0f22 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...