MAL-2025-149309 Malicious code in webdriver-manager-blitz-browserify-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cc0a4eff4c39f48a9eea63ae5964eeb9d4723510f3e9bd81c14c04e40883a88 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145849 Malicious code in ophiuchus-vuepress-colors-elara (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2402ef9a3392a9464536d39559018c58910722a66f3e96b2ea86c9586448483 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in buffer-betelgeuse-frontend-rehype (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c0ef4b2d71dd1d93e43bc2f987e0a94230df746070093c4bf07678a38085182 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in got-izar-acamar-google (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03c2fd8fe47fbb26643f2f916acfececa96c9ebe4b2460bb04ff9de46201fd9e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in perseus-triton-query-centauri (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3fe942855422456b2b094db1bd45bdae5ec15bfecb41962f6257d1a0d834689 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-parse-variables-jwt-soap-metalsmith (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1ba016402a8e1f026cecd68e7a2e6cd6724f0a32d050b391c7016e08c40022a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in transform-uninstall-octans-mui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f86db654307c7cfc379ac92f24a6d4c504fbc65b67b3f390aba1f04cdec2819 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aether-parcel-equinox-cordelia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fea44e964513c03fa384cad1bcf592cb72c5c8ba8c2376c970550df47171932 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in juno-pegasus-pegasus-meteor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 818102e2d582bdb36b85162b7b70ce1601669eda16d16fde3bc826021de287b3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sadr-lyra-eclipse-eslint-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6704fa539bc2ce3eacd2e8de6aa93210afb60ab13b460ca98326284315da87d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jupiter-hexo-nestjs-electron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52307fbec88a4359738f1a4633c61900298bd8f2ce42dfa1b7e7cfc137ada7d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in style-loader-rollup-plugin-izar-phoebe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec4a0e6674e333da99262c9589dc038cd6e957c309248b12349a0364661a27f5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in public-npm-leda-prettier-plugin-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d414b5a8051e12cdb7d2f02f4f7d21f8fe059fbb4aea411607ec42eb2ba24c4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ceres-yonder-global-adonis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a5c9f71ed37b602876a6f437776d9114a08afc52aab7c097268ee51bb86c541 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in procyon-xanadu-carina-antares (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6470c43bd30eb473cf516e28c2579ba27275297d6db3414d57ef6451ac3fbe11 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in terser-docusaurus-vega-metalsmith (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector defa0b5b7d3935632761f8104c355233cdc5eb7bda4b19de5d665c6a77136b1a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xenon-oberon-semantic-release-mysql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0928c9c81d167db71db3f299e5566b1a13b3aee1d5842453431229e9ecbcf7b4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in leda-phoenix-bellatrix-pegasus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce266d563d5b2b900c4c7cb63fe1324d5f2f43ff6fca843bfff590fc2a4e0423 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xenon-xenos-sadr-dotenv-parse-variables (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8462fcddb73bf27d7bcabb1adc1a6ab4a89bb78f09ca7930c977f334739514f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in redis-version-dependencies-zephyr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68e8aa777567e102ecfa9331f56f1fbd8e6f529afe415a4d19dfb6fae86fb8b8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...