MAL-2025-149085 Malicious code in vega-callisto-apex-cygnus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbed3cfe68e3a74b472ac88faa9c8d2bf8dd3dd2614d6a118bed34e17c7d1c06 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143488 Malicious code in hyperion-mocha-start-hermes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a8b887874b9898ac0f6e0f183bc4dee8c0d7a569bb6ad9dd7ef8d6ebeefbed9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145656 Malicious code in nova-css-minimizer-webpack-plugin-prettier-meteor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7283a8213789ed347d62c1e73d10821e6eaaff86e044150ea8b56f0c99867860 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149337 Malicious code in webdriver-manager-webdriverio-build-tethys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a769157d32d7855f2e263fa2a168e8f0f4b9fe1cd1c23bd76f0fc64dddc57abf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146303 Malicious code in pm2-loopback-update-corvus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b312fa8a771ce19d92893bc98acffe14f93448254dd749b876ff74d95551eae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in auth0-request-postcss-corvus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34fca1fc606cf6304fd682277d3fe822752201f5db947bc62472a4202d2ddc2b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gulp-browserify-public-betelgeuse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63d323d7c84f5115e992460072410129438f814ee9e3a999918e849edbe98e5c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in webpack-zenith-winston-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd50777e50a532469b958bf7a7553fe06e2abc0b0bbef40eda0e4ba56e523080 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in element-ui-charon-juno-hermes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc55b9ee51dffe3585c855ea526d5c0021a493b8f3118d417c5da181aa1fd42a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in quasar-electron-geckodriver-vuepress (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3a63df6708cf72c0b4c2dc07ecbb3b9d21ca55caa3ad7e1917c8c401d9860a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in upgrade-hermes-jovian-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7f575ed011ba9abd16d381f3446768c3a2dd8a2a7158234bc708e00b833f70a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ini-rigel-framework-helmet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51e6a460eaceaef16c9333b123fd0edda2d6049e201f24ea333cd2252d55a35a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in delphinus-elara-arcturus-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40e31c55e192550433235a3c031a4cda8b30ee9f66224b49942a341e0b5a126d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chalk-gemini-nconf-cz-conventional-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee6261de89befe399d7560948dc5c6cfa28a821c2887121fb8f9e613cc581c24 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in webdriverio-fornax-duplex-command (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d6c6c69309a6e97ba9068bd9dc84fc3a380e219ae32e32a0cd777771a2bc12a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in terser-google-sedna-orbit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0775d0836526b1356586744f2f09310a0b95b5b37753d43befdf84629b45d6a5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in loopback-mensa-chai-mongoose (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01362edbbd4889b7fcd0958ff4df6d0c1e3cac1f61f9e9a762c6f9b254f4c359 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dagda-ora-vortex-rigel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 408661f6f10e82b3a08fe5c7bd69d8b2fad5a5b6689b808f8b9c3a847c7f9573 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in global-cygnus-carpo-dagda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dee629ba11bfd815abe2fc73f81ae72e925c48c8b82660baf131e78b64586bdc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in norma-cressida-wezen-venus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c325aea0435d135ada4d781fcd39f53000ae8c2fce613106b6a0e4fe51ce8a50 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...