Malicious code in html-webpack-plugin-csrf-link-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 922ca18a44731d301d1740519b17256d39a472601f460a03933bf194565d2642 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mui-cosmos-less-loader-duplex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38d1e0c7e7468aaf6e91a9cb8ddb5c941f752d7608947ba498fde057da170240 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dependencies-xerxes-gulp-equinox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca524df6fe30d9a679a3caf1797ead4065707ec93bdd4b4321abec7aa38cffdb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in metalsmith-arcturus-chakra-ui-fomalhaut (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e328f01f93a5d5887cc6910c54acc8b4c6ad9adc906fd77d0ea49a19e5caa52f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fornax-link-framework-meteor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad198d91229350f652e4ae102f70d8e7ce49ce27bdf04e26787e9a03c241f11d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in command-xo-ariel-atlas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a366c080a4eaa2648f83bcb94435f3176e85614a052f24641242493394fa733 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in heka-jsonp-triton-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4442839a576bde6f5711839aebc86fbf239039a98fb50a343307fadc3dcc0e46 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xo-metalsmith-soap-yakutsk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3eed56ac6234cf263ebbaef75ed8de7d887c7664524ec5fea3555447a22a469 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in impulse-pino-eridanus-release-it (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8168435c54621630cc4dc2b62e83d9bc97325824d39293359dd328c3af275f7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in commitlint-webdriver-mocha-titan-auth0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0eb9f36e47eee948dd38ebe0cf6ae2a2da5e5920cf63ac7a40deb44853bfc698 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in postgres-websockets-rocket-xerxes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dcdb7f97e93a2c4c9871540388ea14fb05fd1fde3053439339b3f20b7591e8a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mui-cypress-blitz-cygnus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 991e983f3904a6d0ef9d7df604599d90c9d1225c9f60e4d425316250f0264ed1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in socketio-fetch-jekyll-bellatrix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9efe617b8bcff506202188a2185730198b6d121b775deb965f455bd330366677 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in scorpius-sass-loader-jekyll-upgrade (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9069ae233c85f24ea1a43e58d24f242ee930f7dce85b47136affc3a6ff7321f7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in magellan-astro-taurus-slides (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cf0ce6cfcc1944002839109c84e81c317bf8ee3ead756f370ece942286982dd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in reveal-md-procyon-comet-jabbah (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcab1159cf76926c18c79e2f1c43d83439f8a65de204c132c99d1e6708726f95 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in element-ui-blitz-rehype-perseus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5703559ccb48b8cadd72f98806f257de1c353bc73844645d168a5122d81971d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in indus-optimize-css-assets-webpack-plugin-antd-quasar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 678c75a1f2a4473c3bdad22140daaaab48fb2b8967e39e94cdf6b036285b6a11 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gatsby-axios-terser-webpack-plugin-nconf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7573c140f2f7c5a7620b581075885de991007171f019efc1cade3e8658883a4b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148378 Malicious code in superagent-corvus-enif-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e241e8e58df7e4e881758896c71bbf5f061b413610ef47186c207cc5ed6f30e9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...