Malicious code in virgo-hugo-vega-heka (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c502d4249c975a4bab93ef877ebd30cc2c9b3b46eb73351f5d2bf350f758b9a5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in colors-testcafe-uglify-js-karma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25e77fb847e27eb950028a1cd40aca131cc9aa67d47344651081fc40be03e6f3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ora-webdriver-mocha-koa-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 264d6148006e14acb388e5a9fa325a0f504bdb13ba6730af51dfd4004aabd832 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in promise-galaxy-express-css-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4d73f608b623f0b3a98949eacc4b35515f0f7ef184928ce7a965fbc14ebff47 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zenith-tailwindcss-helmet-carina (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21ac99628cc463df34bb5966523d40dedafbd2d76d2036558ffc840d3397455e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-parse-variables-yakutsk-farout-slides (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85fb13686d9f413809e624fc0ea150f3dafc56bbe463091c7371e70709cf06c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in process-local-jest-rollup-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ab26fc3b03ef31a02fd7707e51d12da7af5f9bb6a697f7e24df86a5a5c306cd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in atlas-duplex-astro-spectron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba777d8a797ecbd56772ba0ed6f122615394e758366f76afb97e132efb482194 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aldebaran-zenobia-package-blaze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6d5bb8a735237ea7373c3f507ac04632de6eb775b54c59acde7690da38a86ea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in redis-module-prompts-phoebe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d7746c84f9eea454bb717d63fee8f847784b838bc466466fd555a66c2c65e06 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in miranda-promise-odin-rehype (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02962f939958784843b6a0ec0e0006c8a28d63bfb1a39aef4e30c2ef00e89105 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in child-process-mini-css-extract-plugin-carina-tailwindcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0600f861e5c7c831867f5d513940f33a86c60daf9f02ae87e935468a6bb3d6e9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in norma-html-webpack-plugin-version-juno (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84509b5d35b1df7faaa56be4c99f921048932e5586fbdebf4d72f7c87eb39467 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mysql-janus-non-blocking-stream (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3e967f7af12b0fb31e73a1d41f54d76ec7e17f227ad7b707c8debcfc5dccdbb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prettier-plugin-markdown-browserify-link-radiant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da1a8c727ac3b13bfebcaf88f918fb328f6db6db6c868976d5d5db78df819ad9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in antares-less-loader-middleware-sequelize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae569a3671d9274588de48ed5de8d667d2f2d636d898cc6832f261b42ef93686 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chakra-ui-nodemon-metalsmith-loop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d3fd1864b9a5129d2c4228d9955e4d3dc9c799a3aa1f4b18ba2932dd5c4fcdb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in polaris-markdown-titan-spica (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35619b085a70cdc1371d350992894e62fa81e502bb384ba06be4c705b98c6742 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in leda-publish-koa-arcturus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65c65c1ef134ce232577df13d5b79811447fe487ad8ce6ed524a8d47842e01d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144555 Malicious code in loopback-kastra-soap-bulma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e6751700dd5dafa2b7cc3b3121f35df9e182b23f1034caf2ebb6aedeb0f047c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...