Malicious code in draco-tailwindcss-helmet-yakutsk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c8d7941f34ed14c6cb23f0f0ec0dec198e240f770b1788b17d88201f1fb16b5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pavo-process-socketio-husky (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc94a69e8db13868ea7b35d2460be71bc2242a9b526364d04b255093dc4a7037 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in webpack-postgres-draco-bunyan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 765202ad2c860e75154b78975f19a9173bd6a6acf4f554a2f5f02825a71f85d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in optimize-css-assets-webpack-plugin-markdown-octans-blaze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4fbe1c2b2cde5513e863fa8fc192ed8bd1e1098a5964c8016c02142c5a7d565 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in flare-framework-ursa-webdriver-mocha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 762d633d317ce47ae0ade8176855d229355633b914f402b4e29b5b9a2b19a02d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sedna-promise-dotenv-parse-variables-vega (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b4106b8b561425fbf53c8ff86d6d731d1c4ce20b3a437fe2bd4f5ad0a701667 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in luna-sass-loader-centaurus-aether (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2278034b7ff68a8192cf1094d25a5a2c99ad341cce263a582564d4c2ef488cfe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chalk-gemini-nconf-cz-conventional-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee6261de89befe399d7560948dc5c6cfa28a821c2887121fb8f9e613cc581c24 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rest-nebula-apollo-bootes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b0e592212057e4f165a5bc594516e43446e0dd16e1cd02b54fffe7ff5314842 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in publish-pipe-antares-shelljs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16ece4f36eb0a4c0e49c80f8088a1ec9699232370a88da237cc71dba2575d4a7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lyra-castor-fornax-orbit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6637764e61f86def541cb2e44401fe0c0a4957a2704a9f36ce9be071775ae1a2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in winston-dione-playwright-slides (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2acf1752fd78aafaacb9786f57344172402c394a983d209ea714bb25c15b5cfb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in loopback-mensa-chai-mongoose (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01362edbbd4889b7fcd0958ff4df6d0c1e3cac1f61f9e9a762c6f9b254f4c359 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in alphard-fetch-corvus-command (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1033edc9f74841360f05c0f9c2f6b62133e43f267042e802c53f48e1b302043 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ariel-indus-telesto-fomalhaut (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e010405cee714fc544f42d8632a9cd0c8322ff38222e8bb03224e51fc0cd1eb3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sagitta-chariklo-neptune-sirius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5567eaf05d0f398650b7487da7dc6b9f7140514798f1542595b71d792c39c99 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prettier-nuxtjs-metalsmith-miranda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc0530eb1ad39700c42120f582e87d6140918e039de76026941107c4042d0a81 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in postcss-xanadu-test-mira (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 829bbcc100b6a0075043e2dbd7df90af59ab633374fca956c513e20a11fd2a34 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wasat-css-minimizer-webpack-plugin-grus-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5bc4d6d32a3ad2bf2da3f04d696481a91223c21f09d5bf439ab6b67546f3d8e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147574 Malicious code in sadr-process-ini-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e99699493d67b9e69638403e5ff42e8bcb51dde5d15221340e4921f8cdf49a7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...