MAL-2025-144970 Malicious code in mini-css-extract-plugin-capella-lacerta-castor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1b5bc74934a8bac1cf36c483b27d6fbdb0ad09d79f4471cbac2695209ecf5b5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in impulse-global-octans-jovian (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c0994ea4815ebd11f6226078d9a6c346e561085e6173eb701091797e4908a93 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in apex-yildun-iota-schema (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b73ce43507c72532e06d369ad78ad66dcec3bac05ca084311645fb9741df428 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in triton-build-cli-react-bootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1914c9e4e7618352f9b54c4f7f471567662ee798d1e82657b53a4cee766b703b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in apollo-cordelia-winston-mongodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56077965070e889a1af0696d7fd2581636da35f3c26330ba76f8a3b70135c568 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aldebaran-charon-pegasus-heka (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 808b7e01fc3390efda5a9efa37e7d1917a9fbe55cd61b8a33611ec40ce69b373 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fornax-test-kronos-ganymede (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 373b39091aad036983cc8935f0362078e6c6ae8a018b3d351bd14c6c67d98f8b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in link-passport-prettier-plugin-markdown-commitizen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 997cbb9644d6e2a6ea49c021e47526c36a9c49d25715d531b0e999691733fd1a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in postcss-protractor-karma-configstore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d16675a33058376a90e011bd1d015a37a8d8b845bea120f47975b1d70153514a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in standard-markdown-pdf-lyra-exec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9734af3a6b4cfc3fe7e3af82e68cffb82ac31f0c0474818b7ab95d397e331d8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in weywot-schema-relay-warp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76671588f93dcd3775fb5621c6845d8a99c2909349a2f0772ff25b85769e7ae5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in astro-oberon-airbnb-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6997cfe83393bfc484bd912e4ec6f64fea103f08c847d3a6502b9743d27e630 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hercules-impulse-bootes-hercules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f67de68547de78fe4a22fb4620efb725a83577b226dc91ddd3dccd5feabf989a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in meissa-orbit-bootes-javascript (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e2f3aee0366b8961da6c68fcdf85a8a959fc9725a26442353bb2f5b173161e1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cressida-vuepress-nconf-xml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b3fad2a7701e8e70e72d43cee4ad37b3a44e2bbbc521f2696eaf92805c68b54 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cosmos-commitizen-quito-orbit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d396766edb0e28e3c059fe2e8744a122fa7919dcec485819019662e51aa0af36 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cassini-hapi-prettier-stylelint-configstore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 805ba38b148cfabe8f25665943929971e9a2d370343a3be456789c8d84ec390a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gravity-gridsome-equinox-playwright (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4084b8a79dc6e11f6c86a344031dbaf4ba059ec5ef8d2e89110dcae2b9a3ff5e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in airbnb-antares-terser-webpack-plugin-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 621360111310bb1d7dcd6fc7f22631c95a9ca27f7eed5e0424872f4f863ea333 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ariel-titan-forever-phoenix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5adbf729abdaf96b05351bb89f2fcfd831041b8b4de3f84621c7963581e9e9c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...