MAL-2025-146164 Malicious code in phoebe-morgan-install-concurrently (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab149e6b00233a3917e702b778911be536e064049d6f4363b601405122a9e30e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148711 Malicious code in toml-hexo-xml-capella (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c816af0f803870e47672c841645b4a3a9fe5a554904a699390f8a94b5555ba9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139785 Malicious code in avior-semantic-release-prettier-cz-conventional-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad1bee846b0039c60e0e0057b6c29b031b648b21ebbe632243dafe96452cfc5b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139641 Malicious code in atlas-callback-xenos-janus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8aa94b81da2f4a6f4e376f64baa173570ef405d5befe2d774868143eacb0c594 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142563 Malicious code in forever-barnard-style-loader-scorpius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73f68bdb51fd979c6a46b6e31460a22991df841e08029da5c687d6fbef3a4e92 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144846 Malicious code in mensa-cosmiconfig-sass-loader-meissa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfc4774c2b116959c2ccab5c6bf4747b653d6400e83e7a4849c1bf7bb83e1d7e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141718 Malicious code in dotenv-parse-variables-dotenv-safe-algol-framework (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdd4098cf7952532438e0fcee118c18ba0061965c413cfe88a091ffe48f76af8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145560 Malicious code in nodejs-cygnus-sync-markdown-pdf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83ce14a4ddd7e7d11d764543dc23faf3d5934fb6001941a7c607b55b5975b389 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147596 Malicious code in sagitta-express-reveal-md-orbit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec668e95fec75e52b44abe1d7cdc557d71c98e8c073a395a85f274895955b865 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146511 Malicious code in prettier-stylelint-mysql-ultra-winston (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 346b072f90d39311114a92c9e9cd77f1a7d23ef5852c232fa6265d3263e30e4e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148439 Malicious code in tailwindcss-async-dorado-karma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80a64b7109b43ed1c0f9e482fa31d66941c4902b2c0b896b79c946b9f4802507 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143519 Malicious code in ignite-morgan-postcss-loader-morgan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69416919d6a5f042a70f254596d0ddf47863aea254d55875387e2df7ffc3ebe3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141413 Malicious code in cz-conventional-changelog-apollo-europa-child-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a374729d98d86f3613bd69ea8a7dab54201ac5cb5daddc4823cca64866c8c87 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in writable-umbriel-betelgeuse-altair (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49aed667d56d8cc8885f4af0fcabcf078c4098c9b6ba017f25d958cddd56a802 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wolf-cross-env-markdown-postcss-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bf92b6b8c6a2644f72700eeb3abdadd149b76826d296338e032bf88f95a1e0e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in exec-nuxtjs-async-await (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0547138917a1647cd799533fb1a5d590a7076f852e032130c1b80b909a792139 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mui-carpo-publish-neptune (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e2be34a3c332013cc6fbf0b15eebd1688174c135148bd0bc0053a46ddf30815 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in frontend-hydra-morgan-chromedriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2b963aa21771fb79afb2a1d90627a8185e9f4f8c71fc8ee3b0bdbd1516edec9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vulcan-nestjs-nodemon-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bca58c5db7f633962cd43a5bc3ee223af16b073b273e82fa1008712c7fafb6b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in playwright-library-build-yaml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector accd70c1139e0458aefe8218d3b4dbe2ab9d2ed5d6838ed332328f9a10b2e2f8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...