MAL-2025-141246 Malicious code in cressida-subscription-heka-public (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b3980fdce10741215a5b28c7a31b64d573e8ba28e502d529a090a5b21044aa0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139880 Malicious code in backend-chariklo-bellatrix-start (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d05642153386f10d853afc481e3d9d8d97b5e9092a1a7bfe22891c2f88817238 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145632 Malicious code in non-blocking-xml-procyon-callback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63d0a264027b7585c64463a147d401953cef73809abb5f32ecf3d768ab2c538e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146781 Malicious code in publish-css-minimizer-webpack-plugin-nuxtjs-rocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f61de6bef5b68ba25979e912b33bb3e86106a2d722106557cfc8f1fba1d53246 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in envconfig-wasat-bootstrap-rocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af6db8e4f65d41c200bf215e85d07bcac6f0968a2f588d5aa3bf006697614914 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149084 Malicious code in vega-bootstrap-barnard-hermes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df34bfa4f9162dfd543970ac40778bdbf4311d1bf4d0e034d87cf32d5e11e027 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141325 Malicious code in css-minimizer-webpack-plugin-eleventy-writable-public (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16c809fff64854b81d5e2dd566778b8b3f0b3593ce2d0a3267e2f2772472b028 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in resolvers-registry-less-loader-phoenix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 721081aa1d483891bbd09014143becd91e4a4aad2f1cf9b6a947fcdc5e8bfe16 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eslint-plugin-tailwindcss-cosmiconfig-alphard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e8afdb64b20c818f81c4e664f57f0d63604e0f039189a3fb71f2106206e9cf5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in markdownlint-standard-run-script-comet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9c922258173b565aad147f7ab8c8f6e2bd3797075453bb4b7d65c9e6481e66d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in non-blocking-antares-configstore-dorado (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74bf3571b0999a8ef8c8705b0f31f623f8213498f18aaff113a2f2fbb2675667 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139517 Malicious code in apollo-jasmine-pegasus-aquarius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f71845ac8cf484c8fe99a1e0907d4ac0bd2d26a7724145562d9f8007bcf0f8ee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139872 Malicious code in babel-rehype-mini-css-extract-plugin-aether (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a1fc500675fae07b9a876c104374b27b82820a5d8bcfaad02b275aa0426a718 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sadr-lyra-eclipse-eslint-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6704fa539bc2ce3eacd2e8de6aa93210afb60ab13b460ca98326284315da87d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in galaxy-csv-middleware-levels (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 265a90c0ed8d48568ce28902e224b77e7b8d7911333c8d1ab524cabdb671285f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sagitta-indus-supervisor-non-blocking (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7167ec4027a880062b47db9272dc92073a5b9e1998a4a8b0d5136ba3df69cf36 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149829 Malicious code in yonder-alphard-package-kinetic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 505376feba5cac53438c7cefd9cbe12346ab78f4c2b66e41d8a29fadf65b05b5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in css-minimizer-webpack-plugin-pm2-react-bootstrap-webdriverio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e00d5bac178637bc480815d914746b942889f67c66d300e04b2109160a5ef251 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147224 Malicious code in release-it-hyperion-gacrux-slidev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fde1932bf84de464c22989333e926d6abcd2b16e583b5214e412410b33fb16fc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146139 Malicious code in phenomic-upgrade-library-loop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c6da63fbfa2e892e0a97bd188c12afa9f4a7f7644759a1b77e0465f69de6903 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...