MAL-2025-143590 Malicious code in ini-event-dependencies-umbriel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a9c7cfb7f15ef248aaaa8a66266a84dee824fef7044f5a9e9c85acff1ab1726 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144848 Malicious code in mensa-enif-magellan-umbriel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b533e0ae285e04abc18553b4bf644ea798de190bdc453f5ebba48f4bab21c97e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140368 Malicious code in canopus-phoebe-electron-builder-meissa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36eeabd19bdeac8a1ef874d116c625c345e5f293b115ed04241d7f4b9e3d9df9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147961 Malicious code in sirius-loop-axios-hydra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81efe827f5c03793fb107aafce4247391764affcb9f2d64a7af4644870207ad6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in css-minimizer-webpack-plugin-babel-shelljs-convict (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4845b9a3bc9b0f42f3b7cd20d841b772cf37a58a4b4cd85d760de5154291b3e2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phoebe-dactyl-hydra-uglify-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15069d6c517ba07a6ed22a9fc3941b90f3ed7cd9171a1029f4f45dd9c8976e82 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in babel-init-element-ui-nebula (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e99b76e66f4e5103280b258034bc43bdc7140d62607e388d799b69d512579e39 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in forever-apollo-oauth-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90943887c088c5605934a7f3eb8800f69d5e476dce2f64c9ae90f658706a9516 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bulma-mysql-polaris-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 642e49e59bbbe4ac10f5aa70b2452a7dbfe7d5a9928016d8a8fe291fbf43801a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mongoose-nextjs-tailwindcss-xml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df5baef566e823735372d309ad6675fcc3d0de68e618834cdc3931e40cf8d36b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in janus-prettier-stylelint-cross-env-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 791b1dc189284d27d4648571cf5f77f50d62b3a6a7d3d9030af59acc5e12c91c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jabbah-leda-install-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d12f6206cdd8066e12c04469916390bf6e9c7de288ef09cf420a09ead8c87823 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chakra-ui-subscription-vuepress-gulp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f33217d1af956169d2508fc5394110c19795450f5fee3645a7f354e8e8a24972 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in global-shelljs-socketio-passport (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 490aff4c1c179342da3e777f17c60b78ba9faf7a9fb2a45ad908d73cfbb97433 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in toml-jovian-non-blocking-weywot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51f63cdbda71e6348e3fa77a13ab444871e387aa663565f05d8a08312ad11fd1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in resolvers-eslint-markdown-pdf-style-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d5edddf5489e959e628e53fc66c2bd0cffb613bbbcba0037d36286e701a0450 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145827 Malicious code in ophiuchus-metalsmith-apollo-fomalhaut (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80e7e51a83f23a65a177aa0973d2ad88d24a3da3dda667c7cf1f4228fbb52357 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149856 Malicious code in zenith-neptune-puppeteer-nuxtjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b10a2fd2615539814c75993efda49b5c595a87b90f8e157b39f9e05971922a5c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145695 Malicious code in nuxtjs-astro-dotenv-toml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 361f069c8f34b46d870c8a13f9857e804499b8f943a16c7ba015da58b6adddfe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148260 Malicious code in standard-style-loader-flare-celeste (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f9ab2321a1d8bba1e68a004f01d1aa6a51d88faeedf9b2d448f214e64125d8c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...