MAL-2025-145395 Malicious code in nestjs-fork-draco-fornax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06c955d990db2c8b50291158cda63b6a0c64616f530042044ca39f552cee4010 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in transform-dorado-phoenix-mensa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c8c06dcd35b1cd056dad87509186667ba2544e0b69410c71587604ce328274f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in andromeda-csrf-got-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b156646e5ae6831d28447dfb85a6d23732f46c59aebb936a8622ec2da9d24ea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143560 Malicious code in indus-callback-achernar-dorado (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09f563839092782ff7a791175f637db961273e9a255a2fe0cfbb22651e32cb1c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144300 Malicious code in leda-vega-forever-airbnb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 705ba1bffe46a977d02c92d5251392b47fa800e7294432d8f3f44f3f5c584c8b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149609 Malicious code in xanadu-run-script-ceres-loopback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b73720185a49ac547966c6348249905b0f45dbf95e66130c616a4d286437636 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149743 Malicious code in xo-async-less-dorado (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abd699bec9ea713703814b65c3d925c90e38c7b5078f81289df60659781069fb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140087 Malicious code in bootes-ophiuchus-phoenix-pyxis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65cd14c888f39abec4719ca970ce1f6297c3c19feece2bd1c5db6e14e12d9028 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141798 Malicious code in draco-wasat-miranda-node-sass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7854af127c6cde6e23a5aa64329b6e001b5ca79115617c855e6e263daf890134 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144689 Malicious code in markdown-pdf-dactyl-ini-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0224b06c2bc01bac122fd5a5ce40190a7a89a36d255ff938537c7373ca12a14 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147557 Malicious code in sadr-async-rimraf-blaze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 458c850dbe9760289c925af204c42236df3c66d869ff1da15a02801831c8f9c3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147783 Malicious code in sedna-pavo-mocha-ora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f613be6a51ea941638b5a12837877d984872eb3b1f8b708a07c955192e00c566 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in grus-jwt-transform-ceres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dab769d42a98e5e3a53c842163f9c5d812b5bdb3e8f41c58b8ffaaa433b7e9a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in library-eleventy-start-semantic-release (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ef5c3375e9382697062795f0b29e5fe5a516d4292590c3003a1e2eef900faa4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in start-cosmos-soap-style-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c1ba368fddb4ebbcb5c479a5aeffb91aed8d9906574a5bdf14d47291ed1c503 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wasat-jabbah-nodemon-spawn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3b2182e2ead59f86384be92273d8cfde1f64d3a26d5586e5239600a73b89eef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phoebe-spectron-halley-promise (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6609c06d440e2b17c22a87b2aced1df5a798c2dfea152333b4a5a15c25eabc53 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phoebe-jasmine-betelgeuse-duplex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 868bd2cfd9d3ae551d1149b5c520a17d12b7cd3419667f53c2c09909b9312d8b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cygnus-avior-perseus-auth0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28b4880b9d02fdd73016760d9ed188f4394d5b3b0cc2c17e4507049459299210 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fork-run-script-json-bootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a487508b75acecea952348bb04e9172b5b203a5e9a7c982696c74b83d7457b0d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...