EUVD-2025-114899

Malicious code in cosmos-mutation-eslint-vega npm...

MAL-2025-148462 Malicious code in taurus-castor-alphard-update (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eae94e2a9377380ef9720cb8a9629ded2f7adf3290f1e4f280445c25def67d66 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149003 Malicious code in upgrade-bellatrix-luna-zephyr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85dc522606bd3cd6fa13c74d69567d1c35e65f9d1959258be06cf34abce7f7cf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145223 Malicious code in mutation-gacrux-axios-gravity (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df2cb2e0a07e4cb03c277e22d854f9cbc3681de5b051d9d9a3b838494c646a9a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139940 Malicious code in bellatrix-jsonp-octans-stream (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f9cd63d924544f73e5e2bbc1774277ccf7945d6e8a5f3117ce855a7d85bebbb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139679 Malicious code in auriga-install-express-toml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ec57c878f1c91a3125ce5d22ce4ca93c160d03d8b9c78e896caf971f7b8fb83 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147580 Malicious code in sagitta-await-nightwatch-stream (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 599b02ee33e0ca172ba387eb8fee06d5bd917b1b51bf2136c37300c417901fd7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140953 Malicious code in commitlint-auriga-xenos-react-bootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cb906d86cc0ce4b7f22a79fc879e93b1bbbb1edcf8e8ec7e38e60c024b69811 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141487 Malicious code in deimos-alphard-nestjs-oberon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb2a1db44cbf758c023fddc4953d43953b89647c6ce1a2f527ecdd091804b012 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-120161

Malicious code in yakutsk-html-webpack-plugin-koa-mutation npm...

MAL-2025-145225 Malicious code in mutation-levels-antares-nightwatch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6da819c1be7de811f097b3936686090bdd2d7f1d341d84ca575fa6572b3d753 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140577 Malicious code in ceres-superagent-sedna-spinner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6d4f07a457df67ef5a49483ad7c134ca928b0e545316389b55502ad45407669 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148557 Malicious code in terser-webpack-plugin-mutation-mutation-unuk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 093f6cd3625f88f87ec25dec35d3e27866fde2e123a38d30403db5f1abcf7846 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rollup-proxima-semantic-ui-jasmine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 653895f8925b05c1c5a5f3796d814966f8c2eee89351d88d6f07bf2bcdbdb890 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138757 Malicious code in gothic-plum-toucan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2a609b5dcf10477d4d9e3252e4994993f6206ef46bb9c00c30ae5de5ffc8e7b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in magnetic-cyan-parrotfish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69618140d95a93dd960616e1711555b0dd44e745b6e3235bcd933d5a4706ed9b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in comprehensive-scarlet-bear (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91d625dc8392046d7f079d2c9f470edf6e05d3884f821185549c04b7d8a46d96 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nana-kripik50-sumpek (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fb18adb5e377657e23d61aeaede03341168f8c2be68e4e45eba7c94a5e4fafb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vina-empal12-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c32a697fb75d1f9b7978673e11381c61482580f994ccb3b5d7df8457497008e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in laila-kripik40-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfc8e92bd55ff44fa62aee82502896fb980a500805647d58d4f9a093a7e16b09 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...