MAL-2025-140100 Malicious code in bootstrap-comet-convict-inquirer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1090d16dc37057a5852adbfd5f493146d23a9dde058a92e0f5e68cf23ffbe844 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141950 Malicious code in elektra-mensa-astro-halley (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1b808128b662930b7d3ba8de884fea5792a6ea694168add9c96af03ff99ff98 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141829 Malicious code in dynamo-magellan-standard-dorado (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd0e6537f0509af7748578bf409c68509f2a78dd654ab1e5524a808f98d675ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148521 Malicious code in terser-google-sedna-orbit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0775d0836526b1356586744f2f09310a0b95b5b37753d43befdf84629b45d6a5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in reveal-md-postcss-loader-enceladus-xanthus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3b7e1975ba8584db82d63f8d4ed5cfc113066d24a35aac8206fb73a8d4b315c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149647 Malicious code in xenon-jabbah-enceladus-gemini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d67a932f8103657216151be707fe26add8546a8003466cebcb7dfc30570c7fb7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147266 Malicious code in repository-global-commitlint-radiant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23e439146265fc847c2ba6635b34bdf04eab81a50a6bb7b732c0b65b4b98dd1a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149508 Malicious code in winston-miranda-deimos-jupiter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b6de0c14198fd929f6f9dd0fa13157940276fbe6fcb62c9dce5cb2a9209c05c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in middleware-postcss-loader-vulcan-configstore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99d428e4a36316610a46ca531a7cf361eacd9cf94095b45764a4a3d1e7864ef4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in supervisor-lint-staged-nebula-fornax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27f90e24f78db58b9fff6195aa59ba8057d8a2f471f79ef9eb526355fbcfc2c6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in indus-server-eridanus-pino-pretty (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f7af1bafcf102135e7d3764f80c014d3ce8e28f3e9016a0d0ddca3f810f6e01 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in buffer-update-puppeteer-koa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d5463711dac655828a2734f0815568ba460f52891e78f95e73fc8bd7bb233b5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cordelia-chakra-ui-acamar-bunyan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe50038a951e8b1692ef49b02cf319688561c524d88b6c8447356cbde583c218 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in release-it-commitlint-config-angular-soap-prettier-stylelint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd303f21515f0dff1bfdece8ef5956735f37b53c0ae72f27c2547c01d44b88c1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in non-blocking-lacerta-halley-dependencies (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5a8fa6827ac9e19e9e0a00af75cdcff500e2b579e6e078c205cf56c3bcbc808 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in node-config-terser-start-morgan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fd32bf25b58a06b2a70d39b030cfa34a19bc7b9c33000beea84c94963d55dee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in figures-procyon-betelgeuse-quantum (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e6ec9d293aa050ea28a3dac80d3023398df9d62f4a0660466d4fa36a0c7834c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hyperion-grus-aether-exec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d7fecdd0737209befcdd40ff14ff189edd26dc44c878a59f4d80c79df2e29a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sqlite-non-blocking-native-kastra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4bb8d693502367467a865250306d6251623b4fa2b1c23100452f92000dc12d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ignite-puppeteer-sedna-rimraf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35174f4fc9f936f9c62e71fd6996be4ca74295263e938ba94323a36ce579ee12 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...