MAL-2025-143515 Malicious code in ignite-izar-hyperion-gatsby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0894c7a3eb9e5f3c158e630bc71fbdb660de946d7d0a92955c82af30adb08ed4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145391 Malicious code in nestjs-cressida-pegasus-toml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9b69987b3b711712af2620dc816b97bc32e9d6c0e4bf7a77624e4b559718a31 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in uninstall-quasar-webdriverio-gridsome (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c09e54ebc6eec10368771375dbb392a2cd112cb37bbd784a862a602dc472d4b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in winston-gatsby-zenobia-eslint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4539e20771a5e14a396382185985a89fdd823182f16cf3fe399f24140d7e8c4f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in weywot-envconfig-meteor-spawn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5293cbc3ab68ee5e40f6a3c2e9503a885bff68d163cf7e30570724b385c5336f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in selenium-sqlite-izar-rehype (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a8953c630b9079488ae498842bf4cff37440b69ff8f6b186fe0366168f2c841 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phoebe-nightmare-npm-less-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 774a47fdb518927067c69933219ba0bfd8dbf5fb177ea54f167901861846ee65 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in restart-terser-webpack-plugin-sails-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab66765aafe6a3989f3cb70ae24310d06329d976f3d1cd58ff9e5d22b8c2401a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in npm-standard-sagitta-nconf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30e41ca778897239c3e5cf27fd5df06531d908fac9d45d23d17e3169fcf0ca97 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148755 Malicious code in tool-stop-magellan-jekyll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 425754f6af251723808e87b0e68201bf2b4a32eae0c5a5bf3b342e6f57b62f06 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149575 Malicious code in writable-neptune-figures-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45124e351e80cd78250efde43533e5978c66164c5a2b54f3aec853be1434693b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in repository-lyra-react-bootstrap-ursa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96745fb4e087f1d2fa6cc12f0673c34c9c89de6e5261f9db9d80208c34740662 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in regulus-electron-builder-toml-convict (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb363ff17fae4c8c782d0db9a96bc1aa2a403f59fa362575ea111d739766e891 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rollup-global-indus-testcafe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79361108aed6e40411d643c21feabdfd09d5e67872f95b55d72cc8c3d6c230da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nightmare-superagent-foundation-dynamo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea9a41fdccf8d8485cd2d9eeaef4dc462c6259be7925a84e14967be163e5b997 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lint-hapi-stop-nightwatch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06034557f70b334c9c54b7ae8eeaea3fecdc5515f5f60638224fd9b47f87a83e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in semantic-release-sass-loader-commitizen-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f4674a8c00b8aa7f7eb8e8bdbc905e54e284119d17da4639e07eab14a901585 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jovian-auth0-apex-element-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c2832198d7eae378760f701bc5fa69386ff7a313e612cfee8431f5a623fa212 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in magellan-sass-loader-hermes-vortex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d16ff68d2dd7d1053bfa0409aff19e8eb4c277ed562bd9d6407f30d9ed4757ac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in morgan-vuepress-corvus-celeste (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d14f3fb30811f382eb1461ef9900bbc9345ddd47477d39478075edb9e7c316e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...