MAL-2025-143252 Malicious code in helmet-enif-gridsome-hercules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2adb39d8e6ecbba968ccf3078cdaee4dc1337a58a7ffa64e62d214da2649c403 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146203 Malicious code in phoenix-ophiuchus-webdriver-mocha-zenobia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3cc99ba026da8566d257a516cae1495a6154a7a20dbfb8f5dcb605c6e138958a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149564 Malicious code in wolf-slides-nightwatch-prettier (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11d6fa277ac69bd9089da09771fd17d8924184412af68db60a37dd1a2614aa09 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zenith-tailwindcss-helmet-carina (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21ac99628cc463df34bb5966523d40dedafbd2d76d2036558ffc840d3397455e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in non-blocking-dorado-reveal-md-slides (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a02083361929600142cbbd362da8df6c63f05a2d0cf83912d9c9c02aae394daf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ursa-meteor-hydra-oberon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a33770dfbac66ffcb26f1980fbf651debce846bbe4d0a6c950d36e990f3ca549 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in resolvers-forever-grunt-koa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09265b46fdf433576f41f7f12ba7ef773b4b643027adaa79185d07f1850e0e69 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bunyan-morgan-gatsby-prompts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 554139500406b867d6abc54a5cdd58fd294ec3edad56fdbbece0f3987411862d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sagitta-zephyr-prettier-stylelint-levels (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8e0bc5f74d9334238f6e4593bc4bbeae0f83fc66d8a18c2709882e19e7a5326 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in publish-parcel-mysql-hermes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4600f02aa1b42d0cbe2f15feeb35fe523685db00d9a4672ab4254b84fd88a5a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phoebe-prompts-hercules-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5a51660212c8f8e17ba061c5d3c1287bece955ade4374abc8c6d27c3156ddb2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in warp-aldebaran-eslint-version (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0b3d94674faa2d791badc098c041f3b61d7592d45cedc12a36f44ce3b39077c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aurora-yildun-karma-xanadu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 002463a9ef23a3781a6864d5ad3a340c5c545b7720c5f79a22a9477e198d67d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in test-sirius-gatsby-forever (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aeaf14e6e10cbe5a3b607dee0e7b57551519225a5dc3ef21ead34231d78cbdd4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in test-schema-dione-leda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3af9e6c2b2b4d710d8a1f6df5d2630dad09faaf289798dc90e320c66da0f8106 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pino-achernar-helios-perseus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a78d836027b3386068716b796b3c8b1931f3c424a999bb8ecb693401a1ff21f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in metalsmith-regulus-xanthus-levels (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 623f738fdc461b8c38a39da3044e89eb5ded72f45c346f84c268af6fef85d9ab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in blitz-dotenv-safe-chai-ganymede (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89a02bf129c422cf91f95f6f735927b5be16e5aa0a264e7b197ce7558b296472 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sequelize-semantic-ui-farout-public (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70468bbc99ee37949bf80e5206f0f716f5e6c1e218fad639b36f4c6509f7f251 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in await-vulcan-lyra-tethys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed292ee6936e0ee5a9a91b3777a7aa416b690ccdb583cd9256d7c33814053dd7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...