MAL-2025-145417 Malicious code in nextjs-iota-hercules-regulus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 645cceb630baacf494c208f488e2350a32af0532843877e7e691528a0e4a3949 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in loopback-mutation-sagitta-titan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 462802e07ab661b8ece47a77f17dbb548914d1cfa70cd1bfcbabaa8d355d0c75 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fork-eslint-plugin-procyon-fusion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bf6096faa5e10b2c385f98c2600967ae8fad4414fce255c69a7c8ae1ad0d863 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in uglify-js-quito-ursa-fomalhaut (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aaadc495679e60a19ec8445196bd4b7acb163dfea8b86c1a624c45ecead0fef3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hugo-elektra-quantum-wasat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a00342994850ce03c837378e8eda96dd6f80397b14d78a04906aa43710f198b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in auriga-babel-ceres-sequelize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f28d45d234dcd5dce8347016dad2d69193815a03f58182ce50419b00a8c02ab7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-112631

Malicious code in hyperion-janus-mutation-callback npm...

Malicious code in wezen-framework-dotenv-safe-testcafe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87602dc7c2a6edae48bfb5c94901e8a70ec0be68891fd9a43a379fc6da8d7a2b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cz-conventional-changelog-publish-celeste-antares (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eda11c057953654bef26e09da7efd85262db6c8cf366a83a67b5bc4d9063b38d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-120889

Malicious code in ursa-apollo-mutation-blaze npm...

EUVD-2025-115942

Malicious code in buffer-mutation-changelog-karma npm...

EUVD-2025-124209

Malicious code in nuxtjs-redis-fork-mutation npm...

EUVD-2025-115002

Malicious code in cordelia-orbit-mutation-prompts npm...

EUVD-2025-124699

Malicious code in mutation-configstore-fetch-polaris npm...

Malicious code in eslint-carina-forever-hermes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7f91ef5dc4c00f9832c98df57115357c304787af3987b4df8eb1f049d795218 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bootstrap-foundation-rehype-superagent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f123f6cfaa91f9978bdc24cca9623e08d85340a93961fc3ad11dca2454b73e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in axios-mutation-stop-testcafe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ef0f78ec274cc166f0d04c5d2e49ce4ced44fb49664709ba53e0ff780fbd8ca This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wasat-bellatrix-carina-janus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6e7b4fba863e8539203503c96d45117262c003514f6fa24b312460eefc90397 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chakra-ui-neptune-eslint-koa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84c4f096543a30ee5960737681cf9b3aa1939dc04aebef1c0ef66fe0b9706477 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in farout-neptune-dione-transform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c0c1d2d632485105b695892cfdf331ec228fa9c0c4b44667c6207987bd0b91f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...