MAL-2025-140487 Malicious code in castor-leda-init-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d1e61eb88822973087b0503c6c945e9cff5c7871fd776b41eeb9b423b647460 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149735 Malicious code in xml-start-cosmiconfig-cypress (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91eedc1264661a331bb5bda407d0b16cf6ff42036d0c67981b64050be0744e34 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142101 Malicious code in epimetheus-nashira-node-config-forever (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3680ee4ede4d45b354c8e3ae081df1daf439b7b39c5de63cbecbe66cb1ec1eb9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148749 Malicious code in tool-proxima-shelljs-corvus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 700c548dddf10ca56e72c2b175f0ec0af8b18e39f9d0a0033c32499e6a5e8872 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147437 Malicious code in rigel-npm-husky-bulma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4121d03d3d7344a67a6387fb32c258d9a8f98720a9c72f0c3078d499a9a5baa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ultra-stream-cli-lynx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8919da0e5107515453a1601a96d63ff99ed9feb3133d9d1590a4a91432c96de2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tailwindcss-readable-betelgeuse-xo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11ae0e6f8a06367e95d49b65de1d5493df1d604d1155ae3b584b2a93917b4da1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in umbra-nebula-metalsmith-gatsby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fa52ef2c5183342383256462ce7bd6e5e0e14beb32eb9bec251155258b0119e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144277 Malicious code in leda-javascript-stream-husky (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dfd3a055aa44ec2cd08f62a0923cc30385a0d9d25f8e1cba6f22dcde9d89345 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in axios-exec-umbriel-meteor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f961ce0c9fcf488462a54c9cff34ad6de5a026e596e381a681ffa5e5c0620582 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jekyll-aurora-superagent-terser-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 362fa7b5a08f46655c55595aea85b8d947c2a6c1f7c51f727943c991c11c8ad1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143098 Malicious code in grus-polaris-cressida-europa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71ba26fa4dbb1e602577b4133c013d196b716317ba0da07038cef37f6f9ff5ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144982 Malicious code in mini-css-extract-plugin-nightwatch-ignite-capella (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd7abf768c17dcc0e5b07309564f07f447feb5c1795b58c7d519912d70485516 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145061 Malicious code in miranda-toml-xenon-commitizen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7dee0f69be118b6fa662a522d7925c52d6fd145c596702b2748315a189fa3937 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in module-commitizen-ursa-protractor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa3f26d53b29b1bf3883da585fa2b4f95ac153556379e35b88240b0e694943de This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in titan-mui-procyon-pipe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1248ced1e49a7b5b8fd9186de24b120fdbed1c2aa66d43c5beaab197ec4d1247 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142538 Malicious code in fomalhaut-dynamo-luna-tailwindcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82b5a240a7c7f61dc0583aea5a0aa7715dc2ba8d7515b11841fdbe4c62140055 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143903 Malicious code in jekyll-elektra-vortex-dotenv-parse-variables (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88c959720c38f7a9ad315da296dda18f9ef35605b92b08d3fed920e1e332b18c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140723 Malicious code in charon-json-typeorm-nightwatch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ecd5ce8d359b222563a4c16211f8831bc0ae6bc589d8fe9da56a084f89f1493 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145693 Malicious code in nuxtjs-achernar-sadr-phoenix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca69bed6f1ac5109bb281b861bd2e93d1e31ed3f606518daff1af52293e8b111 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...