Malicious code in buffer-levels-commitlint-config-angular-protractor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac128b29c04901328bcb6420c6ca7c26bc5e847daa6dc52991d4dc227b7dbe23 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pegasus-antares-hydra-phoenix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebf4eed890ae6762a203cd1c723509b3f4c0d85ab699e8529f69ff62267e9489 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141008 Malicious code in concurrently-koa-jupiter-morgan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c406a48340215dfc297931ea310432a4f8af4887c0ac52bb24dc2a6d0c56388e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in socketio-sedna-centauri-atlas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81bf5c1589ac18e2c3471d0274bbd2f7da00cb75993fd0a325f908768672968c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in equinox-meissa-europa-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 971426dab5e1c8b4d75b97a1da56d0a5d22b1e299d60a76669042d42416a363e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in module-polaris-dactyl-cors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8a72463d4d1200e3476f7c45575a7a197213739bf5954a2109210a8d2d91f40 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kaus-bellatrix-async-astro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4ef429d9f796ffdace8a3f703b2ae5197b3a9ee8fafd196f82b1f31c7c80adc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hydra-canopus-subscription-fornax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62b87c7c825a2db18e8c130977e889b347093d1698c32df204faa36afa5165c2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jabbah-semantic-ui-development-development (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector faf9fa3d7871ff117c6867a82a58910f6a7327fe7bafcca683eb04b3bf6f4dcb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in metalsmith-xml-thuban-winston (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94f60078b97cbd0fccfbf8cce00fe77723c5d62b3bf09c43ef64de4ce5da2320 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in charon-lint-envconfig-firebase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac6900600a2f703e91fffd3e91cbfe8399ad28bfb5056b5c9925357edbde21f3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phoebe-webdriver-mocha-dotenv-safe-nebula (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4741cab512695c1c5578f08e6536747101c2e0fff2151fbfe86c9ec962f7f78 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in html-webpack-plugin-hercules-aldebaran-electron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fed239abd75124c4ab5323674a97933b59c4e293809eabac3b6a9e8f340b019 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-112854

Malicious code in helmet-native-quito-capella npm...

MAL-2025-145016 Malicious code in mira-polaris-forever-pino (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9839ca6c0ed2a3abb6097d7ab67e407b1aa3ab53b40751672e7c85aeabc8394a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146208 Malicious code in pino-altair-uninstall-sirius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d0423eb7c4257b5d212c7e4a2eddf4cdb96433580e42544234fa6e5818cbd10 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140071 Malicious code in bootes-betelgeuse-forever-xml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f642659a1b6ce09ff66cc79760e53f20dc42e315da65407b73126e5b9842d69b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143196 Malicious code in hapi-prompts-markdown-pdf-csrf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70611763ec0820cf06f80352089a3d6edd38c7a1491891daf9f0bd9f35c623fa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147965 Malicious code in sirius-parcel-electron-builder-rate-limiter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d82865d2c4c118814f34f9e55544cc147c81d7874040ad365913faf99ebac58 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147230 Malicious code in release-it-phoenix-node-sass-dependencies (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 252b6058a3bc8d31180d451e6fdd6db27a4b8de5be62ce3bf854ce7cb5599181 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...