MAL-2025-139920 Malicious code in barnard-warp-auth0-canopus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 638a56cbfc7e9cabefd81eac62370176d9145a9560bf20a0ad39ea16427fa9e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142632 Malicious code in fornax-loopback-google-selenium (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1453791ccec0e6d9af3bb03731b15537c00689db44a6584eef16befedb6d447c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141709 Malicious code in dotenv-parse-variables-axios-rimraf-socketio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a74e83a98501868b14b36dc23df3d406f687182616811541cd1317ec9c0d1129 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145952 Malicious code in parcel-bunyan-weywot-nightwatch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b88bff2320d5cdd691ca28bf7c30f99d4da68b75a96ea9f9ad4d9a602cfefd49 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143514 Malicious code in ignite-halley-jovian-flare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 641352305dc2f90655fc051c707ae15f10e5b860427930d87e2b807717cc2ec7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145574 Malicious code in nodejs-proxima-link-prettier (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63188598f74497a2c47b3cde3e375a0268745c99100ec6cefb8ee6a96c36a71d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145939 Malicious code in package-lyra-postgres-dotenv-parse-variables (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5f43dc858b148e1ce57af54b03bdb8e6c2aee6a4a902f6c4b576d5a9e2d46e9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149111 Malicious code in venus-express-lynx-writable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb8cf852ce1290b0d658feac972c9ad5e20e74bc2a89903c85978cb1c5797c47 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143103 Malicious code in grus-taurus-xml-kinetic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e782c2cef1bcf90360829c12b7ce209eb5f9d611d67600c686d34187ee7b16e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147139 Malicious code in regulus-apex-package-css-minimizer-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b59a05a19349911216fdb272750a19dba669a24491c9ff6994f3988897384906 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in javascript-stop-solis-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 604e6dfd483497d82c03b53aa28709fb0bd1b3c4692e4a3b5af4259d9b7041b1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-114358

Malicious code in dotenv-safe-elektra-build-octans npm...

Malicious code in draco-wasat-miranda-node-sass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7854af127c6cde6e23a5aa64329b6e001b5ca79115617c855e6e263daf890134 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in repository-phoenix-altair-firebase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56358002f8c5f94fc9121e5c7eed6f83e3b6ae720afe694721b04db71840074b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sedna-husky-semantic-ui-dagda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab3ccefa54c95c888bb821b615c7d1714b07731f815f4e005a557e282d65e25d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nova-spectron-impulse-writable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8476b6ac2431658758159daf4a5664be2e497b0c866561f3d28143c03d717c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fornax-mysql-bellatrix-spawn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22bad8ead92b1bfb381b56cccc2105b1947b8cd2bdc46a1e6b12690cf923b0bf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in electron-builder-ganymede-tethys-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6980f4f142809989641586af71b87ec16b320ce93c4364d719427303535474e8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in middleware-janus-perseus-weywot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 855c73910470153009c55832fa0f949acbc8e0ef531bbd95b957e53c22ecef18 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in husky-figures-bellatrix-chai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c7290a8ee768fe8eb682d1a4b184d110bd129efb75b6be7c89154ad79ad18e4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...