MAL-2025-148308 Malicious code in stop-winston-bulma-metalsmith (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09e6a3b48b1fa6a57f7a149b87c21c622de6c043358cb99a7e0448970c1f9783 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ursa-middleware-express-europa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba207fd9cd33feba39f2088ce036150bd5cfd54db1cbb8c7b108f8a6b527c224 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in celeste-hexo-auth-ophiuchus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d92c21a1b1e16f7cee7c32f463513296b72f874f3dc1d5be0b833a8f10432a7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in test-schema-dione-leda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3af9e6c2b2b4d710d8a1f6df5d2630dad09faaf289798dc90e320c66da0f8106 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in upgrade-nuxtjs-express-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f463e51bb569f852016d367e970d1d3e953d744a35949dceac6393af9ea40500 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in async-package-spinner-tethys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67481eaff1ab609487e64181fec0c051ced741075c652753d934342f610f9fd8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146187 Malicious code in phoebe-webdriver-mocha-dotenv-safe-nebula (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4741cab512695c1c5578f08e6536747101c2e0fff2151fbfe86c9ec962f7f78 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139393 Malicious code in antares-cache-andromeda-dotenv-parse-variables (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a69f1e0e67e5d014f4810d287a413d9c3f360df647b2978a8a65cd71af5f0a2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147676 Malicious code in sass-loader-mongodb-elara-norma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7dacee0b3a1644a413676b09faabee48fa2c7fe4cf97c5d529b7d48e2e12965 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141695 Malicious code in dorado-perseus-sequelize-markdownlint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2a611aa258ecfec3409c67e60532f605f7253087d197c70a8d32c2c2f6cdde7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138703 Malicious code in existing-cyan-bobcat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1633ea59d481983ee376978a6a2a319ef27e6a0879ca09fe7a81cb5c45902ead This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in original-lavender-hoverfly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a7cff724291031461ab159ba45bb2ac32653ad7f88919277281836ad9fda92a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in agus-toge69-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 333a2d646b5f8348b6eb3bdbd08d7378e76ece5a0c1fbe7d76451bc8aca44382 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nana-kupang30-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e87cfed774dfdcec624d11be3b83ab385b8bfb090b6977af13418b267b4dc7f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rifqi-kue54-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38d0941842ddf44de909df7407914a295b06efef17cebd30347218e2b52459be This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in citra-brengkes19-sumpek (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbb522714dbe543b15872b2de3d6cb4cd2c98cf3a5637b23fc1a344dbcb98ec0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in only_beaver_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f86b0b1b6155dd3006e7e93c1e7a95bf727fefa2a18af57766d6e35d1001b637 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ida-mendoan89-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba562fc69b1c49c27264e15f77a0063b1ad7d71b97ba705087fb7f1e34eea466 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in candra-kembang91-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0688f6145e867308c2d3e6884e6e46f6483b1b1ec1851bae1cb2bf6aa431a3f1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-136800 Malicious code in rudi-soto84-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fadfac1841c41278a94c0a6437b3eed6a8f053ecc5d29a6311c5dd426072c82e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...