MAL-2025-148379 Malicious code in superagent-cross-env-csv-nodemon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c342fb3e60fa2afceecf9082d7c1b1dea1e6af2b2fb452d854bc52c3d7d9892 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in javascript-stop-solis-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 604e6dfd483497d82c03b53aa28709fb0bd1b3c4692e4a3b5af4259d9b7041b1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in got-quark-charon-prettier-plugin-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2791fdb726654cfab79699ec9ea9331cf5f86011d5e2d08bda7ac54d9a50486 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in farout-sails-eslint-config-chariklo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5350b546b48ac29a1dcbeddbd48f6a6bf51e9bc12a6a2bab1c78cfd8c5566f1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in perseus-nightwatch-toml-achernar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 435de88664be232d1fa2feede964a493b5f441ed93ccc00a9071264916de5951 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in centauri-selenium-cordelia-browserify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5140bc05ac5e03f10bf4b67fcf844a7fa3bf3d15c413dee6007aac2b0c81d250 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in electron-pegasus-perseus-slides (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 671af7da2ae010d3996821b6cebc6aeeebef5043d6a5c62b3fe0d51ba287aa07 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in yaml-tailwindcss-hyperion-public (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21873df11411c0e983ae620ee75aa54dc13b86929ca05c9b2f03b64c18324d07 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kinetic-spawn-stop-browserify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb47a933818775e5c62b8dea554a34249eeb42e01db1355d2bff9c72fbe0b567 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hercules-ceres-jest-callback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 968504ba2b4fd0f91b0925a1a6f37f0f562d4535dd22ce439ac50ad7e2326765 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sedna-mongoose-mdx-taurus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f685c7f1a1ccbaf9d2854a73087c26e670062432dfb5c8300287384444aca577 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in readable-pino-pretty-style-loader-jekyll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08188ff739e64b3bc2b1b4ed3d1a2af7e8f4b787ca8103e54a4bc1bf22a61c44 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in envconfig-csv-build-chai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa540d749d3bafec4df5a69032f942824402ebe3bf915276f5f9071e5251564c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in element-ui-gemini-got-ursa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03c70e5ea1a429c3dc5665a6de9895c3131d1c964a9e1b8e9d50fc6998154477 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cosmiconfig-neptune-public-luna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fe4928a1a9940219865f50a24366f38c974d857bff1aed36844629daf22054f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nova-sirius-warp-csv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 649a56723a38e2cef5365a388126358f1afb950907d8f5b300fd20403cdb11ce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in astro-got-spectron-halley (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f999588a4cb52296bc68b50e588cdc7434b2f57827ce86ef72b7bf111b292cac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ganymede-nebula-playwright-nodemon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e1f1c5a4a1c55419ec29857d1e30fa3543b82900639e451034c7637c80e6af7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in commitizen-fetch-leda-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ad32909ada1383cfdbbe1faf4ff59ab81ad25641643f4c43649a502a9ae0e97 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gridsome-docusaurus-module-ursa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aee67c97a3529471781f0204f2dfbe128842c724b789c58e825c918fae1e87e6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...