MAL-2025-143600 Malicious code in ini-puppeteer-sirius-heka (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f165079f96f534969d007a41855a4d7f2ed41baf135f410520c0d13780012190 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141404 Malicious code in cypress-quark-celeste-sails (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ea4334579260db551945a868a011ad61151a559d906846ade5299adf7561ad8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in html-webpack-plugin-yakutsk-sass-loader-impulse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c75171bf41f9d6323e8da8690e976b0fde84e1b27555a35b0af35e961f43f6fb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in non-blocking-style-loader-grus-slidev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6981d21e3d65c60637859fde1c38681db6c5965ee98576c668ade20b35449bc4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in loglevel-dorado-cygnus-apex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d20dcbe7930e4780eb2a5484ca95bfe14521c72f890429e81afc68209d96c2ad This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in apex-request-relay-sails (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5d1817134d21724214f2fe946a873bdffacb372c5d66c6abf5cb9f37ed49b36 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mongoose-heka-vega-sequelize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 383847364a4a6c5347ff15734218a9aa69c6613e8c82fecc6e11e4bad9d1563f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in module-lint-rehype-optimize-css-assets-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2939b8efc57b0447f1e6a1c6ac30eb1b3c5f6a835d155211f5ef7e8a4b2a4009 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pavo-buffer-terser-webpack-plugin-nightmare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8d2e79cf0f1f1b83d87d8c6546e35fff84daf20d8b66d13f5c3ce3cf02a1209 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aquarius-markdownlint-shelljs-arcturus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35764f15ad355e02733a1c29e0e640aed8a010c4274d58ef2813ecac48f040c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in halley-soap-cosmiconfig-axios (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 878f47aabf7c8d166e8bf83e6a92ca0f1d56d5ae5dbf7edab11cd99f50c7502d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in registry-firebase-less-loader-subscription (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60351adb0546cef9790a9625fb2dbb847f363ed481f8fc352d9657ac57c8b3ae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bellatrix-yonder-umbra-polaris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82c027042fd92c3a30c321fafd4afb495182a3bf29c1f24514ba2afb57de9e31 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in frontend-module-tailwindcss-sails (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b0a42dd3cdb3164f9a7e9e88a05a7fdb8d309d11dc69e5b66054ef4e34eac8a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in quantum-commitlint-config-angular-event-firebase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ac0610553b6d391b26ea61da0ebe011f1788f208b501fa46e2ed0c1f3ff7bce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in perseus-cassini-pm2-astro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eecf795ed972026476c3d217f8d763e7e2c89ff111b2dcd751985e8ac5aef90e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in webdriver-manager-blitz-browserify-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cc0a4eff4c39f48a9eea63ae5964eeb9d4723510f3e9bd81c14c04e40883a88 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in epimetheus-superagent-flare-fornax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a886edf55cd3ecac891714f168adcbb1205bb29b1f61d2485b8f9e54e4e18694 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zenith-commitizen-update-proxima (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79414b36fb87b9e075a85ceb31b5cf9491f928b41b592a4672ea17927ba467df This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in restart-protractor-auriga-bootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd6c74e5d8b67a20911a113bf65794db83dff4dbdd74a3b2a604963ae5a756e2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...