EUVD-2025-115111

Malicious code in commitlint-xerxes-deimos-adonis npm...

Malicious code in draco-wasat-miranda-node-sass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7854af127c6cde6e23a5aa64329b6e001b5ca79115617c855e6e263daf890134 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ultra-bunyan-cygnus-adonis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98e2e41abf9245703a734f0eec2e691c89b7d67a1ef3f53628e3b404f88f4d43 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141784 Malicious code in dotenv-solis-hydra-fork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 204e4c944e5588742767a5571cfc83804f233a9273e1e095b54ca7a84a00cae7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-122113

Malicious code in selenium-registry-capella-mira npm...

Malicious code in nova-spectron-impulse-writable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8476b6ac2431658758159daf4a5664be2e497b0c866561f3d28143c03d717c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144114 Malicious code in karma-pegasus-config-europa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe7dcaac8a0df43e485ca6c5ee3f16edf05faefa4c30aba7801a07fc475e2998 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143199 Malicious code in hapi-winston-halley-fornax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ffb4375f00365f06b4c9ac37c81f570c287f324505bbc1a3f0f648ee87cba9e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149743 Malicious code in xo-async-less-dorado (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abd699bec9ea713703814b65c3d925c90e38c7b5078f81289df60659781069fb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143224 Malicious code in helios-achernar-postcss-loader-cypress (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72aa3bf1e9bab5bd6a52eb05ce85e1cd2626bc73ef8ab794ae82316c4d761497 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143437 Malicious code in hydra-canopus-subscription-fornax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62b87c7c825a2db18e8c130977e889b347093d1698c32df204faa36afa5165c2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142632 Malicious code in fornax-loopback-google-selenium (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1453791ccec0e6d9af3bb03731b15537c00689db44a6584eef16befedb6d447c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139920 Malicious code in barnard-warp-auth0-canopus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 638a56cbfc7e9cabefd81eac62370176d9145a9560bf20a0ad39ea16427fa9e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146170 Malicious code in phoebe-pipe-repository-spectron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5e5e991ebc3e6935e559da0f12e7cd8d6efbb7868d545cd595a7f3e7aee0ddf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148444 Malicious code in tailwindcss-iota-materialize-spica (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8814d15fdbca9a55d84e73b3267423a3ce4f89f505a49f9cb4f368e08ddcbb0c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in javascript-stop-solis-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 604e6dfd483497d82c03b53aa28709fb0bd1b3c4692e4a3b5af4259d9b7041b1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ceres-configstore-jwt-chalk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49b37125288f59175aae4e6dc61e0ccea7b4160d5711e3420d95b347159ba37f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141525 Malicious code in delphinus-node-config-equinox-aquarius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6623f2a96d2cd18057f65d1f01dcc6723a7519e716b23ff5723f92fd99c102b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146963 Malicious code in quasar-xanadu-ophiuchus-shelljs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b19c5c472f26b3df74519b8b1486b54c20f49ccfb9f17144362ea87c8acebff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145952 Malicious code in parcel-bunyan-weywot-nightwatch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b88bff2320d5cdd691ca28bf7c30f99d4da68b75a96ea9f9ad4d9a602cfefd49 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...