MAL-2025-148004 Malicious code in slidev-duplex-polaris-celeste (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb146b0c2ed00e687cef5716206c265a7be0acaeff3082bafc48c1e54e8872ce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141270 Malicious code in cross-env-sails-pino-pretty-neptune (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff472b53ca019f8b396f192549d6ea6ac94ddc96058c84452a9ba0390ae1bc7b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spinner-nuxtjs-dotenv-parse-variables-chromedriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 072a55a8cd70a5c9fd73bd2adee50e90c1391fc076290e349f99a5f1fb100a24 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in superagent-corvus-enif-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e241e8e58df7e4e881758896c71bbf5f061b413610ef47186c207cc5ed6f30e9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in elara-betelgeuse-frontend-gemini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44f3dca50663543b5cf7dc24fae502a6de9e183de1a7d880d65ffdbced035af0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chakra-ui-command-passport-kastra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78aa8bda85f98b1e6f2ce18f280186996e1d6e9bf6b3e726f5bb83c5fa67937d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dependencies-lacerta-hermes-install (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 678c3892029c1b658f28fa5b4cc927adeb359d890e770612dd77011a83b270f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mdx-chai-indus-iota (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7078962811ac003829123acb73f64404da664a345beaa595a158d60b963e27da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tool-terser-avior-less (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6e7250d997601bf9650f92fb361f0b19215ebb038518c5ff63a958a9eb4dca2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in carina-passport-dione-pino (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bfc76c7e554c7c02fa03e7f10bc596b151fa82e14ab6225d84272811a080a26 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sirius-dynamo-cordelia-proxima (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4aa0b9d1c5aa9ac055d76cf23c0ecb2393f85ac92efa3921f1bab0e7559402e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145627 Malicious code in non-blocking-supervisor-ophiuchus-eclipse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f939fe54d02544db9be3e7c6ea222a84099693d0f32fdf8582144f656082507d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144277 Malicious code in leda-javascript-stream-husky (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dfd3a055aa44ec2cd08f62a0923cc30385a0d9d25f8e1cba6f22dcde9d89345 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144637 Malicious code in magellan-got-pm2-jest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 851fa9a1251d2f3610e1280b716ad108aa7916042b919f38a9a34a14639140d3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146264 Malicious code in pipe-mini-css-extract-plugin-vuepress-phoebe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a45b6aabd8e4e2de023abe040f64de12f1bbf276ce13c6d210d77d76db09891f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140698 Malicious code in chariklo-ignite-less-cygnus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c288fec2d5387765684208aa7cf6ecab742922ab14ae5fed28c8176b4093ae0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142047 Malicious code in enif-forever-auth0-atlas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fee4492bc9581277183908f641b1c2574e5a5be753baa776d334cf81c88d2b91 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149390 Malicious code in webpack-bunyan-xo-babel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5edbc209cd1ba1cab6f49ce0e8c5c7ce4cd297e85ac19b2bfff0c1c77377034e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147255 Malicious code in remark-meteor-slides-nightwatch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8eb4bd29b5702676310ac558508cd9e3ada75cc965d0b2dc1edaa13c4b45b699 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lynx-dotenv-safe-nodejs-json (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6919ad399f328ce955067abf86547693652653aed9b5c770929d62db585751ef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...