MAL-2025-145090 Malicious code in mocha-private-cassini-xo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7dc82190d8b17d1f57a30e12ed75fde26ae8e9fb09897bcb4bc0cb303e68b5dd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141598 Malicious code in despina-hermes-changelog-loglevel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f593752911d8dfe88e08602cf920db91edbff3a993835df1bc6faeb4ecb3f785 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in epimetheus-ganymede-native-superagent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36f9e981e62d594dce3c76d2f3f1e4089d7417c37b7e7968a8afa7284894b681 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in procyon-commitlint-resolvers-protractor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 048db8edd78325c3e90ce4b067c733d39e621c74207f2eb16db312b39e5e4150 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in procyon-envconfig-readable-meissa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6697fea7d29b65951aa52d6a9e51701f0dd3f5832e77e69d3997f6e525d28ed5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nightwatch-webdriver-manager-process-cz-conventional-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c41bd5e517f4c9f76a221414aa3aba22babf343cdb3b36796769efbd58eb267c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in postgres-dione-helmet-chakra-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d34bc74442aa852ab5dcc44cd33954927ffeba159d2a166a11da6e369b77991 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in perseus-vega-leda-csrf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbaeffe04cae6de02e05a62a3739a301bfa80d5c4d4353e8d1674a2144edc320 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lint-staged-pyxis-webdriver-manager-solis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc50e3aa929a131d682c28618a24b80bb1df55cb791d02ab06ddbfd580f66fae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in typeorm-uninstall-rigel-sadr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5064093037affed56baffbb0373765a99c6ab2325928393136088d3d07e36625 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tailwindcss-janus-docusaurus-eslint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1e1c10d9dbb89f0b0f2583d0b24dcd813e2e7f27a7a12e0692a0fae4c81c2e7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pino-pretty-webdriverio-sails-rollup-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cb71cd18591ac42686f98b32821d8f499526454701364f53578840deea6ebbc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in javascript-nodejs-lint-staged-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 950a7016236c5fc899c18a2afba5edad822d00009aafafb79a9a52e55dd8a106 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prettier-stylelint-enif-ophiuchus-taurus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb1c36c7e8318e9c03ae9ff620c9c5629c7f9fa3229ad0c5cc87694ef5eae4c8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in npm-package-octans-puppeteer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0eb561cd5abc7f81e4ba2d12ca22ab8d7fdcf3401a02981a73418282539144f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in atlas-browserify-commitlint-orbit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e1d432cbc38cd2edea7a8feca2f8f380d754cd24a8973d59c7454e1e9453380 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in command-ignite-ora-tailwindcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0aadce1574a3d69fddbe0444e990e9999b4aebd9c2e59557f2f9802a0deed3ce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in leda-convict-commitizen-cassini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fed8d2bd7bc5314ec5274d837a577d0e748ae44450cc9db11d1fb8e7a98b1224 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in betelgeuse-rest-zenobia-chalk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 312b4b549a005aa9da1a046674b721c77a5bbad4255dfc8af6bbe1b7c3649daf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139832 Malicious code in axios-karma-mensa-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 410722a9393688cd5d9c27ae34b34821e0521572820fd9dba34e1116e0e430f5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...