EUVD-2025-122094

Malicious code in semantic-release-inquirer-nestjs-publish npm...

MAL-2025-143269 Malicious code in hercules-andromeda-cors-aether (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c0a65517828c759ef112b5679684b76174ea657c94c4adf54cc86b95edbff45 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146326 Malicious code in polaris-betelgeuse-html-webpack-plugin-pm2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d019ca346c566d05986b11fd678198d3a7f42e5ef2de48fd52d62dc516a8c9c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149865 Malicious code in zenobia-cluster-package-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 403eacbc4e8c829cda478a410fd600fef4b12a8d2286f53a393b36e45c6f891a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140045 Malicious code in blitz-fork-umbra-toml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7ed6fff075c7c8191f5bb8ca9ceae5566724e352dfc03429d19a8afd34aefc7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148719 Malicious code in toml-node-sass-lint-staged-andromeda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9998636ea0a280ddec64a269b14991a32a187101be27f6e27765845c99e790bc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141807 Malicious code in duplex-duplex-nightwatch-dagda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16340ab3105a683b811a149bd270ef3c551a0f53e6c9240bdc58022ed1215aeb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141645 Malicious code in dione-leda-meissa-non-blocking (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cdd7424b138fa68f71572d8066f481860e9136ef3c9711080a68be656b53719 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149087 Malicious code in vega-css-loader-json-mensa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9ed9e0c56378cf0db01dbf06e8ed7f5f59821afc593e4fc9501eefb82615d14 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148882 Malicious code in uglify-js-schema-spica-arcturus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 005a31515c78008bcf7e2eef5f7fea48aeee9532c4da633a5c6896e519c9ff63 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148759 Malicious code in transform-commitlint-config-angular-procyon-canopus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48165a2699f25321874bbe5ac49f5923c0ad3b44f2fd99db8d1387f8a765e04f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145610 Malicious code in non-blocking-hapi-less-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 075caf1674ff7e833f0bceb57dab4fd4abd685e881659c5f95b4ac57f926a0e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148546 Malicious code in terser-webpack-plugin-despina-terser-webpack-plugin-levels (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66a9e70bfe7e9a27e65d6e249c139e61ded84d1402bfe4ba2ea4159d2615e06a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141763 Malicious code in dotenv-safe-nestjs-jest-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66ed3cd5df3b5322f2a5d0825228171b515a648d59576428600d2715421605db This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144810 Malicious code in meissa-ini-zenith-zenobia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89373e197799912a2bb2392da8e17d048f550b9e4c9d2d61fd6d0a6643a328c3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cosmiconfig-gemini-wolf-publish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3bd12bb3be8b01b050f726a8cd093fee2c9c5ad5226ec9d820cc45f66dbdc44 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in acamar-antares-prompts-solis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 710985a5307e4e3811843366eabbd123407628a8cca4102320e11638b7b57a76 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in canopus-ini-carpo-standard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cb5be968ca0d94f6e02b8d6c96a37621dce07de08d5bde7184663b619ec78cb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nodemon-sedna-elektra-optimize-css-assets-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5945109b83f9ae125adf57990fa9ae515fb677c2bef5f12a56a6c7192ac91329 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in subscription-magellan-buffer-ignite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19433513be4ae22b3df0ed3f88b8b07c85bfb541265eb392bc91c89d720368c1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...