MAL-2025-148163 Malicious code in spica-json-umbra-commitizen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e26370197219e71a02c3263fecd9518f07a236ae4b30c53a4642cb3efe432a77 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142788 Malicious code in galaxy-csv-middleware-levels (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 265a90c0ed8d48568ce28902e224b77e7b8d7911333c8d1ab524cabdb671285f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143278 Malicious code in hercules-convict-indus-flare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7242dca6f6b47df2e61e95dbc7b3ae53b2eb59021756a5a4ff56352a8137a7a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139933 Malicious code in bellatrix-cz-conventional-changelog-firebase-version (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7adea7e961cad3c42a45809df4c91724c86fb260d0a3f89b21880d783a5a939e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148732 Malicious code in tool-cosmos-vuepress-buffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f837862e72b2e94064b9f5e5c1e83988a35c9b9bc817860e5cdb806edf86ee84 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141207 Malicious code in cosmos-helmet-grus-cross-env (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c0832fade9a9296d4f2dfcbccf8d7199ad9b8487cba5e1383233e5c5b44abeb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149304 Malicious code in wasat-vuepress-quantum-csrf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d54baa5ade6015fb6c9054123ae3a3e98a0e3155acfa1feb4ea656bd3a588600 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143797 Malicious code in janus-apex-writable-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abfdc92c35108b7bac99e9f035fd519cc20125241b0a253c8541000e44936d16 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147545 Malicious code in run-script-gulp-hydra-jekyll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0e525661601cb3fc186374bdbca0cc950bce19bad437d85caab9ae1e341396a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140611 Malicious code in chakra-ui-cypress-juno-pm2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32cdf185ec38aecbc412f7e0635a106bdbaf491f09b8eb1449089a252ce03054 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140710 Malicious code in chariklo-repository-jwt-norma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56fea57889a7f92291e93dd44d909bffc52d0e32fe475648db6b324b9e472e1d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141520 Malicious code in delphinus-jovian-proxima-luna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20db91cb07ec445e3bfe9cbf459d7d84def7257f90e35fe90660aa5e805ae350 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in deneb-restart-dagda-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9377b78d2c9acb5517a17e4f897de6a7aff2b2dff05cecfcc7fdd1b54754ff1f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in css-loader-gatsby-oberon-got (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8a19af4e44ee7bff5a71b4d40822481fb8ccc14538ae978842ec212c121d58 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in deimos-mdx-publish-europa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 191cae5a5020a0919ae5a62e6668e0bc50d53f30c98d7c2746f1d3d86bee39fc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sadr-scripts-css-loader-version (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0668623a90f94b66ef71705f830dfabd5f69de9d20153943ba3999737523cf1f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chai-virgo-spica-blaze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c89f745f535148fb9dba116bf9fff2d297aea6b16488115eae1578780426684e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cross-env-yaml-meteor-aurora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20d215441ec813faf80ea353ec77a212352b199912065942b6bb274f8b4c5103 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in capella-changelog-cressida-jabbah (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e9e9e3261268abc9d9f358e046c33a68cbf459c83bb26bf4bde323534143ee0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in loglevel-dorado-cygnus-apex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d20dcbe7930e4780eb2a5484ca95bfe14521c72f890429e81afc68209d96c2ad This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...