MAL-2025-145486 Malicious code in nightwatch-shelljs-optimize-css-assets-webpack-plugin-meissa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9188b5e4608aca9ab9241332c97595f1497acd8c7a5c7f5ed46cfc93609c0208 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149384 Malicious code in webdriverio-supervisor-ignite-puppeteer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6424a19d1f6e46b75ee33765eb3e2b1b1e49ba83db401debdff270e51bb9ccdd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in elara-impulse-galaxy-quark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 862019025039512d743d8a22f192c01a4be212e4051f80ef7e9fd4891922d583 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in got-terser-webpack-plugin-ursa-wolf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 058ff3c61f26380211cb6100a4dadc0e5377421f361087f0ef9fc8e44f437fa9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in axios-exec-umbriel-meteor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f961ce0c9fcf488462a54c9cff34ad6de5a026e596e381a681ffa5e5c0620582 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in titan-uninstall-zenobia-child-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 646b151bf79a5e785e4c57f7dcb976b16097f205af5373baa8ee4fe21620bb3a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in arcturus-ignite-csrf-janus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30e3b9ed32ae320ad1acddea3e3a6cbb09e432ca21542a11792b20e4b4eb6fdf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in acamar-nightmare-ophiuchus-postcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8116427ece4b8a616d6551cb7bfc44e011193dbb61231f89960d1f91a2d9906 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in geckodriver-lyra-terser-webpack-plugin-centauri (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 574c8f5ff036967a5e3b226fc20d99ae1fecf14ea93e18b4e9863c82e5c82e5d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ceres-eridanus-eslint-config-triton (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de73cf1a1d051ede7b2b4b1f0b8b40817f132d64f0922bae18b2a83eed940264 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cassini-concurrently-library-ariel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92d58bd48897e3f098d0b7eb12450b06e34f0a9ad06264bac2b26370b02219c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-safe-kronos-aurora-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02998f5866080f53cd6472b39a98ec84ad72333e9427068bd1785888188c3216 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in karma-taurus-browserify-prompts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 232bd8b8068a1ff13d4b4659cb36d3a3e4198a36dfc4c886d84bdf7445daa6d9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in uglify-js-europa-chakra-ui-dagda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 548c4fad05d7ef5fb506d0b71b1b06f6014ad824859a8f952b80baa268a2410c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in despina-octans-metalsmith-html-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9384bbb9fc0aa0e1f16a71cc9464392c53182e411ef298e21246033a29d53347 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sqlite-npm-uglify-js-airbnb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2637f91fadf4bce03c3e76a24e70582a9d288d9fa691552a311baf19c0f8a558 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in impulse-dorado-despina-celeste (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39cefd70daa57b4e055538e0ce816ca1bb2a0bec9c6dbc3e086630de381272fd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147005 Malicious code in quito-subscription-neptune-ini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70002200c66b5b4cc0f28f3f46ad6a34726cb88aae438ffc6a091fe5ed4e7af3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144887 Malicious code in metalsmith-polaris-browserify-zenith (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector efeca10eedd2868420a67a14a83dd8861e9350b5413837f1fac9c3e8496cc52e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143289 Malicious code in hercules-meteor-sync-semantic-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f1c40a1e572a21b09edc363496e9529bef3811850b83d40f0e9b07ca9d5be10 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...