MAL-2025-144020 Malicious code in juno-callback-pegasus-xanadu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38149d9fe8687c7e2c46ea0ee733ed9a8894eb2c8cff4bdec6a64bd7493c91bd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149147 Malicious code in version-uglify-js-draco-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a26869fd77a392ca463df0916b836137bfb66b07bbfff340b495ad7e48b566e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143929 Malicious code in jest-meteor-centaurus-barnard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbacca549b788fec5ad0c9e1142e7c3f46b32be1fe505973ced9b749179f29b2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142673 Malicious code in foundation-sync-jwt-dependencies (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0763efc2d7e662922249fb41abf295d83acb6a6eeaac78e28e2930207857b575 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149609 Malicious code in xanadu-run-script-ceres-loopback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b73720185a49ac547966c6348249905b0f45dbf95e66130c616a4d286437636 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148922 Malicious code in umbra-meissa-yaml-radiant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0358f79b248e08d84ae4d893176ccfc560a46651915f8df43cd8af7d7d3f62f9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148592 Malicious code in testcafe-equinox-rate-limiter-vuepress (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 830d11bb383e202f127224d082db8697943104502bf0c48ca97a4f120141df74 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144414 Malicious code in link-meissa-colors-nightmare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37d8a7b6e669481fa904e09e533347207b654c2c73dafbc0f436908439741150 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144409 Malicious code in link-gravity-css-loader-arcturus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a75f70a93f2d197cb9e483e0fb1bcad8f2a0bcddcb8ff63508f3e3bd5dd087ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140449 Malicious code in carpo-mira-restart-cypress (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f1338397dbe4e92f39d3c40c186591ae1ad77a9bfd7a198bac2c4fd27af7e98 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146962 Malicious code in quasar-transport-spinner-concurrently (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce1d6a0636d5218446d56d763786f84428863756f135aa1a6dc761a0c94d774a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in winston-changelog-cygnus-prompts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b60b88130d8ae31195152a9e0bfae2ba8966159706a17f71bd595bec96eee77b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phoebe-metalsmith-antares-cluster (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fca16066e644ed44cdfacbc49e496fdaf106242a6c75d6fa7eb39de9968b719 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eris-elara-acamar-cz-conventional-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6804cf47f84017b242dc1a51998db153f8d0c82cc7961ff287100cd8eaf45c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in html-webpack-plugin-upgrade-remark-enceladus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59399cefad893f72472df77482546ff2e4acbd7f3456d03c6d07554edc9eab8d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in stream-ganymede-semantic-ui-antares (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8d2d21c2aba42884dc74a9306d2b5780925eac3e6e9fbc5db65bb2e22d780c0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pino-spica-leda-hyperion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c8cecac1c1179d9823b5417fb59873c0562de62cc50e700c3015893a3f59ae9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zenobia-redis-inquirer-altair (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62577692ad5350d3327022ce9fd34ed152f4a6dc7818c1977c932084039feb75 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rollup-lynx-halley-local (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa72a4e4403fc64b5e80a29aa6fe134a65347485b04d344bf684201c40dae9e6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in proxima-testcafe-passport-jabbah (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7503939623e2f2cc3290f01f62d9d166e37761cb02460542b82c17635296970 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...