MAL-2025-139794 Malicious code in await-castor-middleware-chakra-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bce9d7732b56596adfb5fda97c2500f0a29f16cdba6713c3badf04c3d81f0b63 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144958 Malicious code in middleware-jasmine-nightwatch-fornax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b8766d8d60ad74c2cf23402725bb2b7a3c14dd9413d43c03914e39a047fd977 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145613 Malicious code in non-blocking-lacerta-halley-dependencies (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5a8fa6827ac9e19e9e0a00af75cdcff500e2b579e6e078c205cf56c3bcbc808 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phenomic-got-uninstall-pm2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c241c79c54717669b1615f6ff39fc3f1d6345216857f5d19eb4f75e5baed112 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in parcel-aurora-pegasus-version (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0850d9ceb923ea3b8c1fae4e07e33f2a81a4e2efb322eab5c70dcae054468a4a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in module-ora-polaris-winston (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5fb3d2b6cc8472f5b6a43dd86e1ce3f8fd4d3aaba4f83deca9ca99ee64f6f7f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jekyll-castor-dependencies-nashira (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c96e67c6ad324876e8e775f06dd8ca2818411b3b50df8dd9368f502dfce5e7d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fornax-postcss-loader-umbra-webdriver-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 383f3b0b1391bfd0c00a3d1e37ddbcccfb1df98f150dc0f63769832c19d0e281 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in node-config-vuetify-less-loader-version (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 413d8078725859d1005cfce9ffe26542402304c431c1b404966f75b708ed7d35 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-safe-mongodb-aldebaran-nashira (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b0e12bf9d49a17b3f056656d733afb0a4d073c5cc6fcaa8739c6844049706a5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xo-metalsmith-soap-yakutsk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3eed56ac6234cf263ebbaef75ed8de7d887c7664524ec5fea3555447a22a469 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pyxis-config-eslint-plugin-exec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9039999becb8512da6baec8c9a9785c430ce5c276938dacaed4906dcbcde51d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phoebe-rimraf-transport-gravity (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d320839b4d250dc51a6c8d4afcf02325f2d067157ca501e732ebea5362aa8ce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nodemon-rollup-dactyl-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2b432f0b0c2f9f89aea56397185205c9ac09c7aba0ad4d26bb0190b556c801b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in auth0-request-postcss-corvus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34fca1fc606cf6304fd682277d3fe822752201f5db947bc62472a4202d2ddc2b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bellatrix-axios-babel-element-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf95012ad35bf05dc6070a021a48ea1bcca166e963aa2404e5322f93c71b73bd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139806 Malicious code in await-redis-bootes-pulsar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fab3da84f1a9164a7140d015597595bd0fbd9955000801582a5e659863835325 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143065 Malicious code in grunt-helmet-jasmine-loop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1f342771837b6a879ec6d49eb9f7db8a6667d95f33fe036e25e319b9828ccbe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in development-dotenv-pyxis-ariel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae211171bc2d9b5f0fe3cc61c3f814bb976c29080a1cef7a633af982f93147be This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gacrux-google-build-convict (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2e1026076b8776a5abf64629bc49bf72b89ae170bac59cbe6d152fe94085f49 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...