MAL-2025-141182 Malicious code in cosmiconfig-gemini-wolf-publish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3bd12bb3be8b01b050f726a8cd093fee2c9c5ad5226ec9d820cc45f66dbdc44 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gacrux-google-build-convict (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2e1026076b8776a5abf64629bc49bf72b89ae170bac59cbe6d152fe94085f49 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fornax-postcss-loader-umbra-webdriver-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 383f3b0b1391bfd0c00a3d1e37ddbcccfb1df98f150dc0f63769832c19d0e281 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phoebe-rimraf-transport-gravity (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d320839b4d250dc51a6c8d4afcf02325f2d067157ca501e732ebea5362aa8ce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xo-metalsmith-soap-yakutsk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3eed56ac6234cf263ebbaef75ed8de7d887c7664524ec5fea3555447a22a469 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in auth0-request-postcss-corvus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34fca1fc606cf6304fd682277d3fe822752201f5db947bc62472a4202d2ddc2b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nightwatch-element-ui-wezen-shelljs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b726f17933e589a1638016068587f34dbd8f34ca68c975c0ddfdd7d9b38d6d3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144463 Malicious code in lint-staged-pegasus-chalk-spectron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c65b96b85ff686d1cdf5c755e0a2d632a44a975b46e822479027d76f97232a2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141804 Malicious code in duplex-browserify-magellan-fork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac7466a01a5be6f74833c766c462326c87f8675e1a5883a6027ac90454c2d797 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148473 Malicious code in taurus-miranda-yonder-quark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9522058eacf385789d7b9d2dab9db3cb50cac6b1660e926378d440f667f67abb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141728 Malicious code in dotenv-parse-variables-nightmare-aether-run-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 293766d85f705540910cf4c7fa5b34fed1ce2705dab395aa9b0d51f30ed0ce72 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in electronic-indigo-fish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2314fd521ac8a50f510a66895297537a7f4a54a01b3766cf686a03b4bb10e31d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dramatic-red-primate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a18632c06042f55d22b79ca3d45debfbc72ed14d2eb6c51670bb22e13e2186d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in initial_catshark_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b681b5b64ba38d5ec50c880446e2d81aed82d88b97c15aade3441fc8a1a54c2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gita-takokak68-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6dce0737e65bbe4237b7234f2308fd578936613351b1784b23b561ee5fd72445 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-137490 Malicious code in udin-menjes59-sumpek (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e39c43694b287452d0f471c7a13cfd19416caa4fbe63d6893aac2b673efa578a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-134389 Malicious code in irma-brongkos31-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05e0f75b0d8e2daac39aeab0493b6247cd5e949b74d065f8b972304a5d68a88c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in galih-lapis73-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f8c3227c7f9264068f5bc5f7189a63567d24393240fbab4c2805f29fcbbac83 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-132965 Malicious code in eka-donat34-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 879a6182fd7a058052c50cae3f471d4f8385b5b04817fa8cc1f0c6e79a4c1f94 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kresna-ragi9-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82bf335597c2b161a0da29372cb230fc1d811151d61c0ca72a4f290e192119ce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...