MAL-2025-187109 Malicious code in ganymede-public-canopus-hydra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8666d987c2ffe04eca9ec038bd50b9769fb0d7618dc1d35751253b44ab3d5d39 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-180077

Malicious code in big-static-delta-private-cache npm...

Malicious code in australis-geomorphology-adonis-babel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bc6492d44c87fdb81d4918be79a52ba4d8ee13d391912cb34aaa21f5470ae4d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in library-kronos-start-ceres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 809337d37e779bd9ce52e2cddd68c7fa1c0fb249e9ba2dc8d1c9655e1e3eea5f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in resolvers-superflare-chalk-ini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3250e8c09895d4ddc264575292a76402b578ae6c4695e8628f61bee0932024b1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in magnetar-thermosphere-nconf-quantum (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb3bf2c4086422c764867c661ecf141e5cc312b3f3356cf4be94e25ab2554769 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in blackhole-prettier-plugin-markdown-achernar-redis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bb53a6893f547e5d2b550067d21c5dd4f44f24103e7ccc2d9d6da09bbda4292 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pavo-auth-sedna-polaris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f8d23d3284dfb5d8c816252d592abe31569453c9b4989f3dbf8910826ee9a4d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in umbra-octans-ablation-deneb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b8978bd923183b2f8c2adeb260b1beacf5596db8503a689fa02d4d665279a18 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in user-double-signal-node-upsilon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 331f615747fa4552139398bd5bd8ab96fb56c9ffdc6d81e14eaece427b08e5f8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cressida-prettier-plugin-markdown-pulsar-stream (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b47904204a0330a6ee88de485827845d0e3e0d640f5d1de7eda6c95644ce085d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in serialize-quick-alpha-book-resolve (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c3a965104bed503baf5938acd3d4dda26b3d1e3317487000bed52dba4bc6959 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cron-kappa-bash-serialize-beta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53deafc5f542e358e2be400b3647937108a888871b1dd73316f4f4157605370b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xenon-apex-ultra-zenith (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d255eba690342099284d8bf8a8103b1b72404c253a39810bbe3abd1882f8030 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in link-sedna-paleomagnetism-npm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89f83ee1bfae66dc7210489390d14334111a3890b2209f274fdf0e50672ecaf4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in emulate-sudo-query-balance-air (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40e4eec2a59cbcdf3ec68a88c1b19fbd9aeb9ce1cb89ebba9c49b3ec09e41ac1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in publish-vuepress-sails-foundation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8174eba67733225bc2a363540d7f5712c22849add86bbb13c447eb8e2266a409 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zenith-registry-materialize-quasar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21e56cf6f9d386fc0387e7eb45edbcbcbfbc0d7739f3829b7448f383ad832400 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in start-iota-webpack-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a864f90e149e2b4496c53b9311b410904ffa98c5015ec30a16c6e3787810c0a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in socket-mock-java-rho-spy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c73783490d318eb38b0f589f800124ffffafbe09192fd2fb01fc5ce1f82b4195 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...