MAL-2025-142063 Malicious code in enif-sequelize-callisto-buffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ecdaf7d09db460ea49ef4af746993205b3c7f4df469d8757fa497731a2ed8676 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141614 Malicious code in development-chalk-rate-limiter-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27945306c863c8a6c27ff91abae72c44edef7189fffac57067a019109c805089 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146856 Malicious code in puppeteer-nightmare-lynx-mongoose (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acf9b9a4d323551112c1b97a4bf77dd72a6a18b3f8deda45f95f89e1e48f6f18 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148280 Malicious code in start-run-script-sagitta-proxima (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe781b616783272336fc83c52ff140f961736366976234f8bf7a06d0ac590387 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142995 Malicious code in graphql-apollo-europa-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f721d637bdbdecde413ec4901bb6ebde3edb518397261179621a070d8e961bad This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144801 Malicious code in meissa-css-minimizer-webpack-plugin-kinetic-apex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd3e37d1cf32921aa706fc4ffd97c8fe9ad694e5c8c7a37d55e39241b81f6b39 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147048 Malicious code in rate-limiter-soap-colors-testcafe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d26fcbb86fac321c2a89996c3d3a5ecbae4265c62ca42ef3fb425c829669460 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in local-wezen-dotenv-safe-ultra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 281fe684a136130d7565ab0e4602a9cd866bf34cc9f1ea4a1be03ea6ae16ccd4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in frontend-phoenix-hermes-wasat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f13dae0a6b9099cf69f24f905c54a9e0d5e3b7825909735087f068e4787d854d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in webdriver-manager-bootstrap-rollup-plugin-callisto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec7bbe5e837b28f9e4274f2918f25ddbe0c195af41f7991b59ecc91728eff530 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in airbnb-antares-terser-webpack-plugin-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 621360111310bb1d7dcd6fc7f22631c95a9ca27f7eed5e0424872f4f863ea333 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in axios-canopus-yildun-socketio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9c75cc7e529e037a08e7f6d94af5233d867f429b98b4a180494c1a58efb9d67 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prompts-wasat-charon-cosmiconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8812a5f00b2abfe082d0356b8481321b48341d4051a93e24483b59a2c6ad66cc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in release-it-mini-css-extract-plugin-prettier-plugin-markdown-commitlint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eef36d47d6ae8f741f94ac19f984fd1f6347dbc887b13c2ce02e86997baa8cc2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in electron-altair-charon-pegasus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50f8987084f5e4f89273db6c3ac75d507dcd8e0ad08677026e9f464d11e4274d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in request-magellan-nashira-jsonp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb038937d8f4ebb3e7b9922687f8503ee4277c16c3b7389a6dd6a4e4770f21c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ophiuchus-jest-update-hyperion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49c5507f525f0b7c13e0a023ac4998e1cb4cbbd33c5ed1721695fa1b08ce51c9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spectron-webdriver-gulp-quasar-janus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8ec1782fd94cd2a052595c443f107e56f998bdf4ed021084cc0ac67e769f89b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xanadu-auth0-xo-kinetic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2b26664e016b9ce769434fbfbbce3b3a7ed799f42d2c8b2848fda3fa7fc2cbd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in configstore-callback-redis-gemini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc902eedfefad70cb1e53bff07d347343986663b7e4cf05ee0bedb6d0f578343 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...