MAL-2025-147505 Malicious code in rollup-nova-inquirer-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f33f361a42c5d6ef8fae97296eb72132192a355ff8bbb783c6031b36c63d437 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in barnard-nova-sass-loader-configstore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1b57c9e983fd48309f566dee903920286b373bc535312593f2305034cd2ad64 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140379 Malicious code in capella-axios-build-ophiuchus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6de1782855692574879b52f874525f81e799648d8226dcd053e2552dc17fcfb6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148455 Malicious code in tailwindcss-slidev-antd-elara (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0be2c69fad5b110b2dbeeea015fbe299ab9aa61c3feaa29d68a296c5fbf22be This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142829 Malicious code in ganymede-xenon-public-csv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22712844b046b055495c9f267eb2ca2d0528d3206da37d3cccb5acb32f064412 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140319 Malicious code in callback-transform-zenith-node-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c953f1fb8b54c6e121fdc9cbe6f1bdd0d608434856d465a8f014ac782e54595 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143775 Malicious code in jabbah-despina-ganymede-indus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c08487eae01616838ee0af25f1ec0f33d36b67a802b28b68bd65cce837dd8369 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in quantum-request-ganymede-parcel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daf998a0e7af42b71493aa693ca18e62cde4c66e8d1990b7c218436af02d9682 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in element-ui-gemini-got-ursa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03c70e5ea1a429c3dc5665a6de9895c3131d1c964a9e1b8e9d50fc6998154477 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in redis-leda-cluster-transport (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72f45d2fe6adf84fd0c2f42c793eb96d05298d3426eb60758303b4494bb90a66 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phoebe-sagitta-gridsome-child-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c21ab02f0beafb5fa437dd180f105f309ce3d3df62066c7a2ab2a0177deaa74d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in html-webpack-plugin-csrf-link-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 922ca18a44731d301d1740519b17256d39a472601f460a03933bf194565d2642 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in materialize-winston-rate-limiter-webdriver-mocha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d32100a3259594ef76f131d5e2f949bf6d101cea8093c1c5dd99660e9974f9cf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in quito-subscription-neptune-ini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70002200c66b5b4cc0f28f3f46ad6a34726cb88aae438ffc6a091fe5ed4e7af3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in magellan-astro-taurus-slides (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cf0ce6cfcc1944002839109c84e81c317bf8ee3ead756f370ece942286982dd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in carpo-async-ganymede-init (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30455e0f409485a1dc7ed4659e0f3c508d3a48c6b811106230b3a148fbc8881d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in altair-betelgeuse-enceladus-callisto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71fb3f7b4463505afebd3b0ff6cf7659a5f96f8d926abb737c831d07e67e6068 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mdx-dotenv-safe-local-readable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 061b9f93bbb20e42b5152a86e387d3e303f889c7c7c740e8844b649cf43deca9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in library-ganymede-axios-phoebe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2f571dda046abcbb1c1c42ee2c0d27e57c8f35d99e5bc05f426ef1ffdf76dd8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in figures-version-carina-framework (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3513c6b2aae948d358ed83dec49f13f53edd21ddd9d26e0a8146e9d9bfc18824 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...