MAL-2025-145813 Malicious code in ophiuchus-duplex-koa-json (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 026985088b076b41d3553a135400fe4e6195e5a076210af526056f647ef5ba1a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149630 Malicious code in xanthus-lint-staged-blaze-cassini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48371502ba6002b8a7801a52efdf30de71ca25226e57ffdc898f8c23115affe0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jekyll-framework-meteor-dotenv-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4453993e9e542910feb59b22993715eb92750b637596b75e30f94b7f65d1520d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jasmine-xenon-solis-sedna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c0dee32d71c4e60b53942d2193254fc0fb9c1cf75c017ce3a1bb5db672386ac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in library-ganymede-axios-phoebe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2f571dda046abcbb1c1c42ee2c0d27e57c8f35d99e5bc05f426ef1ffdf76dd8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cors-semantic-release-sagitta-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7555f2b8b283d0f1b33880c0aec348d71a94b6f520787045d49a43d4ead12f36 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cross-env-optimize-css-assets-webpack-plugin-dependencies-nightwatch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f584af0f6b2d8c55e83c6ece1901ac4ceacd719853a62846ab4d14f8550a18ff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cressida-cosmiconfig-bulma-global (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60c22c0927ca3f278d5fc1401aac47dc002fb3c8939f62a0355e42fdef64a16f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149528 Malicious code in winston-sqlite-typeorm-quantum (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0583ba8d9067af98e95c066865b38f493fe46011683758f8afbd70d2cea4b9a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in karma-cypress-pyxis-redis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf134834ab703042e9e90d1e29e10fcfb977b6d1e8c9f5a57c151be712a71fce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in capella-concurrently-odin-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e725700b52d2456b454b11f61182cf74dec91a57f7e2a4bb09487941480646e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139548 Malicious code in aquarius-sass-loader-morgan-unuk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6cd9cd586c41afbeb3e8333ca04a4240347ab41002bf5c1c9d9665191c9c366 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142070 Malicious code in envconfig-bootstrap-uglify-js-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bfd4098356c8ae408716b081b72671e5e811c3ef40bc851d469ae14849c5741 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142720 Malicious code in fusion-apollo-style-loader-envconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81e697bff033a44314f01620f35bf49c622e6ce1d0f971103c8b1871fda65d10 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in halley-polaris-kinetic-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62d343989e159b61f75d4d492dbe2e9f167c9fa715769b532eba6a98ddbe76d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in resolvers-backend-antares-atlas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bcdbeb5f3f8404e93c29ffd571f029c12b4afe279214521372044e00e6e2b9c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in upgrade-mysql-publish-google (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2da9396522975edba628dacfcb027f00702370cb1940abecb62f565310e1772d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sagitta-yakutsk-celeste-procyon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90591d766829f3a790ea4d9c1652e0505ea1c2f38420ac201bf0912f328d2cf2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sirius-leda-algol-flare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05fbc3669df0d35be47cbe0140850a63481a6f1f7446b8c464a7b5b0cad5508b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rest-docusaurus-xanthus-atlas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b51475e0d0ca1aa3b5682e8e921a79c3fd824d58ffda5d2a89baa2069c373a7e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...