MAL-2025-139399 Malicious code in antares-config-mutation-jekyll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd8607db0f5cf2f8df42373224d4090df0a43cab1471cdd21e6c2bdd337fe782 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141141 Malicious code in cors-venus-ganymede-ophiuchus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94f72ad5f784dee940ad28978b1bd0d8d0fa2406b3ede5cb29dda4a9d2647f9a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148760 Malicious code in transform-cz-conventional-changelog-electron-builder-tethys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8a8a2acd4f5979240d2cb94b41ff2e23f5724b9ccf8109a4e25260841a8fbf1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144136 Malicious code in kaus-auth0-dione-redis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e8daa66d3ad3bc016afc3ec7e198370914aeb3104fbc6b0d6d953e52ed5be7a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145658 Malicious code in nova-farout-test-auth0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 521e78db8a996fd04f18ae7742a48645081c3a357c1bca73cb3ef312bd9c87c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chakra-ui-neptune-eslint-koa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84c4f096543a30ee5960737681cf9b3aa1939dc04aebef1c0ef66fe0b9706477 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in quasar-rollup-adonis-equinox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ac168b880ae287e65f1638c1badd728ba959d9184a9c4540169154dec70e52e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in perseus-dorado-nodejs-farout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2068387ab80adce0759613f29f075a88784c8817a194f0f24b0994bf6ea4f55d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-124702

Malicious code in mutation-altair-readable-janus npm...

EUVD-2025-121622

Malicious code in stop-slides-mutation-non-blocking npm...

Malicious code in markdown-rollup-plugin-quark-zephyr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector faa58f284a8cac376e8e3bfee0622f1478d5c0ee0e9e7ab7763a651438499b33 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-124685

Malicious code in mutation-tailwindcss-websockets-subscription npm...

EUVD-2025-124696

Malicious code in mutation-foundation-mocha-cosmos npm...

Malicious code in exec-thuban-farout-xanadu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a5e0f5863dba7b13ecdb47a3d26a8bfd96552671904133c0e357bc0b6071099 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in postcss-loader-mutation-command-procyon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb9a3c6adcf58d65fce9eab22e16677edddfe56f8801398ceceaf8095c67cb4a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-113478

Malicious code in fornax-markdown-mutation-got npm...

Malicious code in despina-galaxy-auth-subscription (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 316d9045e3e8076d3037b7e88e029d05d1a61786e6f3a223a912231e8e694c48 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chariklo-zenith-proxima-configstore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4d16309eec2c4b68c617d8e3add8ee19c0b69ec68801ac360a1206f5773a74d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cache-optimize-css-assets-webpack-plugin-winston-mdx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26a3d4d5f839eabf76c1685618852ca8f8e47c947a0394f2e9ae352f14632373 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147438 Malicious code in rigel-polaris-semantic-ui-lynx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f909b3a7f01141b9fbacc667aaf91d800373fbdfde86330fea106757063bae4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...