MAL-2025-141627 Malicious code in development-polaris-lint-staged-procyon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b2c638e326aa053f682240e547e9f90a7b769046b2d21739ef3ca2efad26ca1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148106 Malicious code in spawn-sirius-venus-jovian (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4135237922c194529580f1e2d58a8ea86cfeaeafd6f22e5821f21fc7240da818 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-116849

Malicious code in airbnb-fork-mutation-fusion npm...

EUVD-2025-120169

Malicious code in yakutsk-chai-css-minimizer-webpack-plugin-mutation npm...

EUVD-2025-121371

Malicious code in terser-webpack-plugin-mutation-mutation-unuk npm...

EUVD-2025-123520

Malicious code in postcss-loader-mutation-command-procyon npm...

Malicious code in fornax-markdown-mutation-got (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffbcdc7bcce2ff393fd1e2c0c05e1f17bbe1e11892186f9dec5884fda469b203 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in electron-builder-jupiter-markdown-schema (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65e6c34d8ac0eb601de5dbe1d8ffd3e9486188b296e4dabf08a27344637a8159 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139774 Malicious code in avior-loglevel-hercules-mutation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a673a6c10ed1fb774ba0a37635703be63874a22ef2aae819b4fb1d6461e8efbc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140636 Malicious code in chalk-elara-mutation-protractor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1515b30dee8c82bfcebcb435e5df8978d0fc0d4f8bca09af47446eaa856d90dc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146401 Malicious code in postcss-loader-mutation-command-procyon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb9a3c6adcf58d65fce9eab22e16677edddfe56f8801398ceceaf8095c67cb4a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148686 Malicious code in titan-nashira-achernar-carpo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4483f30bf3af73574f51a767375f451474ab54c0ac90c82e2e69c9fcd2d14b62 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140219 Malicious code in bulma-mutation-server-ariel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e33c9fe09bdabfbe33847cdc28274813f327e3a1bbc8730cd30684270260cedc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142108 Malicious code in epimetheus-solis-perseus-mutation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 415a02f6ef7c9186bc59da0060c5f4eb21123c0ea1bd1513028d932bb8964e36 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141773 Malicious code in dotenv-safe-public-puppeteer-publish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7456e281adc481a1ca201e721d3fe84c7346df5388c89034a25d87af3201aa73 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144091 Malicious code in jwt-webdriverio-pulsar-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 216b2edecfd28fe0ce40416480e2ede3426f58029ef3fc875e276e21ea492fef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145229 Malicious code in mutation-puppeteer-dactyl-morgan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5573cde9eb7f58c50db9c8a3d2f003010d9e86a0331f9e8cc3f75dd851d1b6d5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148859 Malicious code in typeorm-toml-mocha-capella (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2cb6c01a744d2a87102e2f7a4c1544a42bf5ce2168f0ef424b8ef24f9adddda This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146475 Malicious code in prettier-plugin-markdown-async-taurus-xenon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d625e1e6d14f36eb8303b64de0589d97be599d9b9217d167f908927d88dc6476 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147776 Malicious code in sedna-miranda-lyra-semantic-release (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4515a7c2f104b0e68f888aae3fadc0ff3cb0d87097bd8d5c7e8f3f2ca52d916 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...