MAL-2025-70895 Malicious code in structural-lime-crab (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d35ed53ca2b803218563b1208f6b298f06ffb72467bd82416c7e9eccf380b999 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in written-orange-gopher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb7da59d6418c8202629ed2e75af9d079847539741f76c3cd6fdf1eaff0da951 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in inherent-magenta-cephalopod (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f73822c8bd215742f1873560a5a3ba9cd90768860fbc0e190c1478311e77034e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in profitable-green-panther (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f91686d45309b0a417b076bf6cde089a175e0ba54e426d1fdb5d07d6d9e21d9b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in miserable-jade-quokka (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bccc27504a2c72acb8535403ed01a002af8d8b10e10a0e19e8c6732ae0b52b7d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in shivering-salmon-junglefowl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb864a160a877f1bd4927aeccf9b9418ca0169485e1e13d400706b7a43f89a56 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in inc-turquoise-ape (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af907267455f9fcbbcb270b63e8144b808f98c148adbcc29c881673fcb807f16 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in formal-tan-bobolink (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 542b2facced6d66e1651bc6e2c5f96d212ae8c3175379c52b8fb2a8f4531c2d2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ill-indigo-bonobo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1b30cea900f1631201a6a311183ede185a9365548fd258fb64cdd5147830b58 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in conventional-jade-pig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b59a6e178aa07eb2c19f97b0fab2fdd11b2e00878eb234a8fff2e6118a616a43 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in interior-blush-guan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22cafa567178a7a53031107dbbae1b4faa2e08f5b7060870cbf6f44f9b13b34f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in persistent-orange-finch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d20e4743043a3df2a5fc357a0eabcb6580905c429ca759b76f72b7047a7347fb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in parallel-tomato-chimpanzee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6dee76d153cdb3635360c8258f7e0d2fd0c3147fdaaa8b9d36ab7799d18169cb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in presidential-bronze-magpie (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0b9d08c0d733891753d96f784281e7b4f57b28d722a33fedc61be8d25017ea9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in collective-amethyst-pinniped (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a0c65e117306be60ddecd607f8537dc81cf1824f1dfa79a22fe45e8ea2c29e4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vivacious-white-constrictor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1db600c4af5daa756e8469d9a60965e474480ec7570a0b8e98e7ad7549f697e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sole-jade-hoverfly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35df6dfa2e0050dac0a8e6606d0181dae90167f3fb07b74e226fd3c95376b1e8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in blind-tomato-parrot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47ab5387398377f8fe5b26d3a451a47fa90b026af1b29dea1aae3761a18eb6c4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pure-aqua-possum (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47094481b82d5f3a5b550ce96144c7841203251943602384c4ea545c26d10437 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cold-aquamarine-reindeer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 595653987fa31a45a30f71e6e139ede2fca9020e7ac69f179384ff61a7cdb319 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...