MAL-2025-139696 Malicious code in aurora-cache-soap-solis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3ced08f984cae28d25fe2b4810bb45fc53cde4f66aa701e9112f87a78947c5b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142485 Malicious code in figures-version-carina-framework (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3513c6b2aae948d358ed83dec49f13f53edd21ddd9d26e0a8146e9d9bfc18824 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139533 Malicious code in aquarius-adonis-vuetify-xml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ff73a1b6084a0a234b5afc948ee60df5e2b6dfabeb69b2b8cfbef60243f9ac6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142413 Malicious code in farout-gacrux-bulma-altair (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4181aacdd872a8c8cadfe1311cec3abb2ab56bdbdd2d394d5178998e429bd21c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149091 Malicious code in vega-io-prettier-stylelint-development (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fdba254f331a198ad29d4f9ac5c0b302bbe4413db07312639d2a4882d8bc2c2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149863 Malicious code in zenobia-bellatrix-gravity-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1c29f1918a6f636e7b6bd048f770510b7604e2b3c0b585ce4537f242137fda3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147516 Malicious code in rollup-plugin-fomalhaut-pegasus-hyperion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5763019dd989f8dbbf267900bfeb1126a620a032c9813daaca52b3a21676a6e2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141735 Malicious code in dotenv-parse-variables-readable-dactyl-dorado (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb3fe8fba115d5787ca57c1183f16a661fb0dd62f372ba2f47737309bd8cd39b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141992 Malicious code in eleventy-callisto-forever-docusaurus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 447abbef07e2169825384d0a4f6cd21674555dac84ac23aee274c4866a00fc20 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145311 Malicious code in nconf-dorado-blaze-cz-conventional-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14ebb80e8bf00b13131bbcd85b50a8f37549e9e91d183e6378da97c6b1847e73 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146820 Malicious code in publish-vega-spawn-enceladus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf2589b6efdb50910eacfb7ccf4819dbcb9694bf2c4dc977393e58ac92e7430e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teaphahitqq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c22bfac3a31bf85f77f63ac2d1004c7779f42692ccc4b5f0f31474282377192d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149762 Malicious code in yakutsk-chai-css-minimizer-webpack-plugin-mutation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5302087986235bd39e060db5a14525c740168f2e57d7920582b9991970f2ade5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145285 Malicious code in native-backend-dotenv-safe-mongodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 781f6d6927036e8ba7935aa91fcf468079fe5edef66c51944922fd9b13d986e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in await-dynamo-europa-development (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9d6d85e8e7408451d3696998f145b53a266be50a39fc04a312b692cb078ef01 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in event-eslint-airbnb-loop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b096961c6c168651a45f1b2a9ba7214908d42ea718131f4fc3a17e6e22a2b642 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in perseus-kronos-figures-commitlint-config-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5eb27018f4f80f4bc6b981bd4783b7165ec1289ff35009e4723281ce7b6b0d97 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-parse-variables-convict-fusion-vuepress (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ca6eb8631db89303e16034582660ccd74eeb93a6ba715b0bc50d4579f7ee47c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in apex-pino-neptune-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bdb944f658ed68cee18e920c32f8c3cb2c9810b5b8551c7e42d18eef82f85e1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in transform-terser-webpack-plugin-centauri-radiant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab2ac4b03271cb16933b3bb06352dad2cabd957adbd7ca78cff43af67f244e68 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...