MAL-2025-160696 Malicious code in modirai-igno-jiugu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78dff1240bac7837c91f4a47f940fa2f5df02b8ab3a3c4e827c02ea0f6501b0e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-167988 Malicious code in teagood-yakuza30 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99fa58666d13c977aa93cabde83d8e6c2afaf3e0e1c52a8d50913db3e13eb647 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-156701 Malicious code in inufgi-gotumafa-anfafoaaaz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fad50b9be4135a0acdf3745c34c68a914bb87262897fcdf118b08ac2fcb5612 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155880 Malicious code in ican-poke104 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 503ac9d7076f3c1bae9b59f429951c27dc62e3c8da72875f3c4175b03f5a49f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-150993 Malicious code in @miptaa02/uu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0192769a43da50dab975f349ba64936ac99019f8435134960b290aa8b350afd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in linear-plum-cephalopod (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c818e662b2c1f0582429a212cfafdeb259044c5e9a61b528d10cd36a0bf61b4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in imperial_chipmunk_yellow-21 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50646c9f945000028a8fea3f69a5b46d49788cbacd85210cdf67ea39c0fd3658 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140402 Malicious code in careful_wren_blush-12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc5695272820a4e805fe88080377b4907d706724b525cf83d9c1c2806ce486c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ini-lynx-triton-forever (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aad36a83db4c18f6d235decadf06c6c601b0f3aa88ea21b13a2cc6f1809ea172 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sirius-leda-algol-flare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05fbc3669df0d35be47cbe0140850a63481a6f1f7446b8c464a7b5b0cad5508b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zenobia-javascript-transport-acamar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 582ed82565cc2459fabf0fc9b1e689521a7becf110b9799fa259ced54307aa9d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in commitizen-hyperion-passport-celeste (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31ae678ae08345a4d7d7ab5562656176892d798325e14613abaaa1ccfd761396 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ariel-cosmos-arcturus-firebase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f35bcc97047b629dfb67e111296a3dd5abb69a9c51e03a51548ab42d6356e942 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in testcafe-relay-chromedriver-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 096e192a224e6245da34ac9aaabd4b13fbd2de99af1246befa43a62dfdb33cb7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in css-loader-gridsome-postcss-loader-yaml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b76708fe5d0a2195e1d55421d5eb35a7bfcffe8ce7ea160c4bdd464e0fe4702b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in transport-commitlint-callback-andromeda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f807ba3959fb8ddea8aadf86e62f2917a3c17d64df2cc7a46f80fb9868c3d97c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chalk-run-script-prompts-css-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82ea2258006845312d46ca56f78e72c5ffbae2d7e22d59b5775e81b258d8558c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in local-xo-supervisor-prettier-stylelint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6a1be4297ae91e7c9f380f7cda1d94309794c765c1723339327d6d7ab5c587e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in husky-xml-kastra-await (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7f9c2bf1b1dde395f39bfb95800a0f14b8fd95f06ea2bbcea41cf3fddbcc839 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in alphard-superagent-antares-mysql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbf2031cddbc5978edd7175e265db1b17377473bce5d6cf2b5e972cf82573504 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...