MAL-2025-141784 Malicious code in dotenv-solis-hydra-fork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 204e4c944e5588742767a5571cfc83804f233a9273e1e095b54ca7a84a00cae7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149639 Malicious code in xanthus-xerxes-zenith-semantic-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0aaab4f3ea217467a70f14e891243628cfce6deba769208c9cb54a6e06db8786 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149743 Malicious code in xo-async-less-dorado (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abd699bec9ea713703814b65c3d925c90e38c7b5078f81289df60659781069fb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145442 Malicious code in nightmare-node-config-eridanus-configstore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6677d88fd923cf9115bbee04bfca99325c4c905ce3195c80e37a50eedd33ddf7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-122113

Malicious code in selenium-registry-capella-mira npm...

Malicious code in historical-coffee-quelea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b6593f025cf4fe4473f5fe807674daf7dc74ddcd5183077aec7803f195a005b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138903 Malicious code in nutty-emerald-bison (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c0fa4900235fb6f238809419cd02afa43297d01c65ffd16ba7c6e7afe2b43ac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138581 Malicious code in adequate-purple-lynx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df65d9ed90c6b0e40b3541d480b9b1ba126f97ee1c1a5ff0683824c7d064fa45 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-117068

Malicious code in spotty-green-mouse npm...

Malicious code in grateful-aquamarine-dog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5352403d2c82ea93e9612c7592d466b84ba466cd6f4bc1dadbc563994fead63 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in inc-tomato-hoverfly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 286c81453c169eb334dd954a990db761b5fe48b124e4132b65092030af1cf1f3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in okta-keraktelor67-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69070965056546d2591a01db2fb1a18b3b77437c8d5c48cef398ea2960b21265 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in indah-teh29-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 221d9fe2fee42b7e3f88fdc3c589fe0f053afabc3bf21c1867b01dde7a9da9a6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bella-lodeh89-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef335d0cd7ee7e4c18d79d10ec472237931757dd7f095f741cdfcc1ae7531b89 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hanafi-gaplek74-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78b95b3b1a2489f422f4b48e1e038fe1be36e506c54561ff57335ad8ec97b412 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in agus-sambel59-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c8e04e72621409c47f47333be2e974ad991682c58463982d574a90dfa154f34 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in putri-lumpur75-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e37b32452a284d138676acef25038a22c48d46f20bc27cdfbf51f809f0c0acd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-137669 Malicious code in utomo-sate14-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 296d3abe23b84ceb16ffb53d51dc468b3225007be756ee467e492a0041e2b88b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-137741 Malicious code in vera-tahu65-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b2baedeefcef30cdfee5bdcd34b52ae5c48cdba9ba36f2f6ac03ac5ac98f1bd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-134803 Malicious code in kiki-kue64-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5faab8afd3130212129665acc6bbd801d6cefcff9bbbfea8987c6a062891aed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...