MAL-2025-160681 Malicious code in modirai-igno-jimg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a727ea716c6db03d2302ae2bce40fab835b2a24ac80e1a099ce6bfdf58612453 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-152901 Malicious code in astia-al12f-darhaso (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 544b2f0a06b68d70a34756be6294c0007df861658e217acfd4d48475ad6638b1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-160316 Malicious code in messi-ftfa-fdasuf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9ea6ad4df36e591588d7df625e81cfb50d7049ae883d1f49107ccf90e822056 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-154978 Malicious code in fadila-poke98 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 076a4559c0a445b708b569907290cb867b8a3a2ac776a6b4e98a9390dcd93bc3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-157804 Malicious code in kuinsu-uiu-vilkukmbimi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 345a2aa62978c3f4f0f5e80c6e55f5d25d69028e8917917e856e78f1e9ad7334 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-158576 Malicious code in lookingan-namakiki63 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9515e4f8da31d309e3608cd3c51cb931d7a5b559bfd912c7e1128acd6e32ca7d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-156312 Malicious code in ilop-9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49a35081871394befe6e9ca9aa5b2a1d4ec5e953d09d47d4c571ac9ffdb76482 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-154564 Malicious code in dian-poke32 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43a5f1d9701110388d119c3e6c8818817715ee48786c58b3cadd68917fb10484 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-163408 Malicious code in nokire-sekiya20 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7dd42a07524186ab4fc543ff24226ae7065fd279c4577ac72ae79a7959dcee5d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ariel-zenobia-hugo-grunt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a9c0bbfdb2f4db105e962a12099bc5ed6eacdad8927eaeb93adf91598749009 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-parse-variables-deneb-lyra-repository (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d12ee9ff99eacf328cdcd425a35bd5f6511ae844d95df269fd45b8a33b65be7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in commitlint-config-angular-firebase-node-config-wezen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4f2862c90083d0e858dbc19eddcb13d4246beb63decd5dd5511dc3e4d9f3fcc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in babel-xml-config-hyperion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 704102e6299151255ad2899537203756fa71f9da3d5977119078cc1302d822db This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in barnard-perseus-hugo-nuxtjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93cec9ecfdfb8a0c2c57e573bfa90f86c4ed7013b554937e53b33494174a0e5f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in karma-deneb-umbra-yaml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a97473185bef024c93924990cbe14eeae502c2bf156a233ff17b916ea9c0aae3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-122834

Malicious code in readable-pino-loop-nightwatch npm...

EUVD-2025-114093

Malicious code in eleventy-zephyr-radiant-subscription npm...

Malicious code in kaus-dorado-hyperion-ursa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8659173b63fc0521c5da9433000bf134a4cc63464820c15a17a0fabc844a3ef2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dagda-scripts-callisto-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a65067c64696414d0b4da2d866416a0e37392a25616c759a9d4a8d485e05a5e2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ignite-supervisor-mocha-polaris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c036900e6f404ea72aa85a4bf54d4a73318c1e65912111e0b97c5588f50e239d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...