MAL-2025-148187 Malicious code in spinner-castor-commitizen-dependencies (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3d63d7d06b5a118a91516b5a41f47e4a941c8c4b433eab51718c01dda4b1f95 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141129 Malicious code in cors-mdx-spica-adonis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45a41993407581197ea7067a764303b3c1766883415c39928ee3651e5278e64f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gravity-dotenv-safe-quark-publish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b46743d185d3cb8c0ab240e5bd2abf54d2e9eed58e86663014e8e9ec32d58bf0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chai-cordelia-quito-playwright (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8f3e8c12a5e507af7ff89897aca212fa0d62f72bbefe7c7107241f0d4f3606f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149536 Malicious code in winston-yildun-less-loader-dactyl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a69a769cca21c2b2a2a822e2da066c9daed6de27648e615f57d6c614b2376b8a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145107 Malicious code in module-koa-metalsmith-xenon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1bc283f477976680eaac5b0948d6b00ba0ea1609e62c32da3e1d5ed24f1be92 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142206 Malicious code in eslint-config-prettier-plugin-markdown-zephyr-airbnb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81b3ef52b43da2fe6d4c198943373ceb6eaaa3a2711589e609220e6dcda6cf2c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144717 Malicious code in markdown-warp-gridsome-jovian (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d91a7f62068f0a585e503506bf772da51aee6b14209f21c8d75739764856b854 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141539 Malicious code in deneb-cli-process-protractor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 456e0252c4e2a30003d54a2df3e186700c4398ac5252d762bff1e11127186e02 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149840 Malicious code in yonder-polaris-loopback-vuetify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f79d04e4807dd38afa59089ccfeb76f68af1b43076a330232e0bbe21e1da2f1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140326 Malicious code in callisto-cli-galaxy-centauri (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bf556bcb08436ef6833d0ed35cb9b7b1780cbd5bea5d5949a951f74bd975cfc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143336 Malicious code in hexo-apollo-janus-pm2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c05007f5fa2858df75a8256dd3fad6c0555590c1cb53011e0ce7dacbc72478c3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147183 Malicious code in rehype-run-script-soap-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c743fbefc7e8cd66f8c40a9ca654f606ec61084227cc77fff259a56548994d9e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in umbra-fomalhaut-cypress-bootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21e610ac0879d7d61e6f41f0587dd9f753775a9d82956e80f4a8a486ae1f56d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in auriga-eleventy-venus-neptune (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2496a63bee7beb3167c28e31284ebf45ceda5dc2fe54d573431cd05f1daf2bf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in carina-postcss-auriga-less (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5f7eb49ca9a8f5960086bc7093a2e8660219468302235c18df46dce850a980e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aether-sqlite-meissa-quasar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29327f59a8318f6abc51bcfd6abe17a7008f1530fcf43b381c55f14e7d32ce27 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mysql-pegasus-restart-rimraf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e7009905cb8f53560de954853c4d20a219c322493bc7f7bc00c89373ad493a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in avior-neptune-io-redis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 159acacb064f7f4b882ac1b31bf36ebd3aeb9ab58dd49a8c614929e0aaedb33b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in protractor-ceres-pipe-dagda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e1f5d475d87b9be1e9b5b9319d5a267f7c1d579104ea2bbd5c75147f6239988 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...