Malicious code in cosmiconfig-gemini-wolf-publish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3bd12bb3be8b01b050f726a8cd093fee2c9c5ad5226ec9d820cc45f66dbdc44 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ultra-shelljs-aether-jasmine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbc7346b040e81bb689df3bed542cce8811d5d73d35a48936f4312edb9d0c62d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in terser-webpack-plugin-foundation-less-subscription (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c15839f0d43950e7017ec6478f3d5043f812bc56814c15fb3687c2a636ce3446 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in enceladus-ultra-promise-helios (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a416030b6289ca86673836bddccd53e96ca3cefa44bba0cd43978242285ba90 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chai-zephyr-jasmine-stop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d141d9e454317e0cf8e1698d576224400e48df61534527f0678f0d477a7953c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-113449

Malicious code in fornax-winston-browserify-registry npm...

Malicious code in subscription-magellan-buffer-ignite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19433513be4ae22b3df0ed3f88b8b07c85bfb541265eb392bc91c89d720368c1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vuetify-protractor-dagda-kronos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b637e3a96a8fe046e69b6725f7e6c57b244ed0b4bf061c54739495dabf5ee66 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-122094

Malicious code in semantic-release-inquirer-nestjs-publish npm...

Malicious code in airbnb-gacrux-concurrently-betelgeuse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f902fe71cb86fc56849ea755fcc2c4cb1b0f2d2b8b5e2ba0e79f9a3113e4a17c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in apollo-fornax-mdx-eleventy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01371186693cd024e100ee510bb53e5d734a9461fbc86607990f005fe83045b5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sadr-orbit-publish-request (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37a8270fc0017313bc154b75a1fb4da0c00fc8f3d414844927e0012cdd7741f6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in remark-meteor-slides-nightwatch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8eb4bd29b5702676310ac558508cd9e3ada75cc965d0b2dc1edaa13c4b45b699 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in miranda-octans-gulp-restart (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7c04744516354a46168a3b4f2b000db78743727db300bb9c7527fd54bac5d8d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cosmiconfig-mongoose-elektra-corvus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43a6deb41a22933f687a06bdb4715751ebacf040b3f620a0ea5feaa7ff7ad923 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in taurus-chakra-ui-quantum-webdriver-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58e6b7854d6337054e86865f3d0eeb753d04fc6c8d638b25c469819ce5daa294 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148719 Malicious code in toml-node-sass-lint-staged-andromeda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9998636ea0a280ddec64a269b14991a32a187101be27f6e27765845c99e790bc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142391 Malicious code in express-superagent-javascript-hapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9b794550053245b66618b7061c10440b97b535bc4dad030d638689510877234 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148759 Malicious code in transform-commitlint-config-angular-procyon-canopus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48165a2699f25321874bbe5ac49f5923c0ad3b44f2fd99db8d1387f8a765e04f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148882 Malicious code in uglify-js-schema-spica-arcturus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 005a31515c78008bcf7e2eef5f7fea48aeee9532c4da633a5c6896e519c9ff63 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...