MAL-2025-68394 Malicious code in formidable-beige-krill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7e613d0b91a00fd09848f3b591c616a3f0e1ea39c51dbc6f202556e7e7c3779 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in exclusive-black-hookworm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84e509df9e9f37bc6836c7b8ca7045fd36fe7c81b9385348fae638ece4a6d839 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-51158

Malicious code in vocal-salmon-yak npm...

Malicious code in empirical-aqua-anteater (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d9d5b932bf56517d8470b61ad758e1ae23963b8b991da6ba1ee4283e0be9ba1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in imperial-aquamarine-bedbug (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 959a2604b81e71a4f0c58569cc46250c0c5b3656e24fbb9d820a9141cd42916e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in detailed-ivory-boa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e331722fe96d65ba71e58316b7a239415a5946ae270acdb5fc67b37c1c82d01 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in accessible-amaranth-hookworm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be5b912d2f52ff2c50ca4b9726f5104b58e8fe33f98bda27f7cef6abc2aa276e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fazzaaz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d491762c7d2799c51a19c66478a9943ce40c8d7140498cf0a653d582fe31c1df This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in encouraging-blush-cicada (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19d4b8f6d0100932926e0cc4675c9f3060cc43bffd9cfe92680e70ea3c4f3043 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fast-gold-koi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1723aa1f2a8dd3f2a26517cc26f4264ad864c6232a91408e27ca3f3f274dcc93 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in due-fuchsia-scallop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8233f9a81d661b583abf0e7f6cd8fd2d386224570185ba00c76dbdb233edda5f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aesthetic-crimson-bird (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26c12bb56bace184d324c5207fe72726d18970c5e8af1ad23b73ddf99a75dfed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in deaf-sapphire-anglerfish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff1b3654f6df5052ba5f77a4b9e59899f7bee538b5ee6ae69e48b1380eb3a991 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-67640 Malicious code in dear-cyan-skunk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1ef5d3298b5cc6abca8b99ae6c8e0092b3636c984a431b6fc496ed22ab74144 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-69028 Malicious code in just-cyan-cockroach (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd5bd077c35cbcce3bc86744dbfa412196b4a11e95402eb66d69a580f69698e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-70607 Malicious code in shrill-rose-opossum (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 701ebe54e2710a358995bcc0ac3b2940c4729788bd2dae185030e8f8256b9f16 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-53634

Malicious code in jolly-azure-cheetah npm...

EUVD-2025-55995

Malicious code in adjacent-peach-viper npm...

Malicious code in generous-magenta-hoverfly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3db0106b2c99d3cc235a0ee8c7ea68fdd4b69f237784dda15181a85f1302a844 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jealous-apricot-skunk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9207db87e4031c77913a4b269d478ea65450fee184212b367c29bdec8884d423 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...