MAL-2025-139862 Malicious code in babel-inquirer-luna-corvus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e38df1c945aa945c9dd792f46532d5559c541240ced77f7885300dabc208c963 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-124689

Malicious code in mutation-puppeteer-dactyl-morgan npm...

MAL-2025-148859 Malicious code in typeorm-toml-mocha-capella (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2cb6c01a744d2a87102e2f7a4c1544a42bf5ce2168f0ef424b8ef24f9adddda This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148686 Malicious code in titan-nashira-achernar-carpo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4483f30bf3af73574f51a767375f451474ab54c0ac90c82e2e69c9fcd2d14b62 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-124693

Malicious code in mutation-levels-antares-nightwatch npm...

Malicious code in aether-sqlite-meissa-quasar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29327f59a8318f6abc51bcfd6abe17a7008f1530fcf43b381c55f14e7d32ce27 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148463 Malicious code in taurus-castor-concurrently-nextjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6fe561439df87bdc121339b0b1da0ea314d89fbf61cc470407caebb67f86795 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140219 Malicious code in bulma-mutation-server-ariel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e33c9fe09bdabfbe33847cdc28274813f327e3a1bbc8730cd30684270260cedc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141773 Malicious code in dotenv-safe-public-puppeteer-publish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7456e281adc481a1ca201e721d3fe84c7346df5388c89034a25d87af3201aa73 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146475 Malicious code in prettier-plugin-markdown-async-taurus-xenon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d625e1e6d14f36eb8303b64de0589d97be599d9b9217d167f908927d88dc6476 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140636 Malicious code in chalk-elara-mutation-protractor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1515b30dee8c82bfcebcb435e5df8978d0fc0d4f8bca09af47446eaa856d90dc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-124702

Malicious code in mutation-altair-readable-janus npm...

Malicious code in cache-optimize-css-assets-webpack-plugin-winston-mdx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26a3d4d5f839eabf76c1685618852ca8f8e47c947a0394f2e9ae352f14632373 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in deneb-public-lint-staged-zenobia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a5f757976b5c1d33d87826c3fb999e29d6ecc67ca0b190cb803237d8aeaa20d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in perseus-cluster-betelgeuse-quito (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8566c2ab12a83f43b06b438c52d6e0cedc4ae293d1a73f53300b8db6e9422b08 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-121622

Malicious code in stop-slides-mutation-non-blocking npm...

Malicious code in protractor-rocket-terser-postgres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6784835499ff275075838e347dcf3d09c0983db7b6cf15dada34f13e5f0e66a1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-113027

Malicious code in grus-canopus-mutation-quantum npm...

Malicious code in auriga-babel-ceres-sequelize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f28d45d234dcd5dce8347016dad2d69193815a03f58182ce50419b00a8c02ab7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in draco-spectron-webdriver-nashira-eslint-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0da7c3d576d83e54ed8f3ec17a17754a6a137239e745e659438cd861b60b1e66 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...