MAL-2026-10311 Malicious code in ishowfeet1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49cfb64273573166bc38b5ef83b722b3a264c8e19870fc65b35eaaa5504a69bf The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

Malicious code in nottuff23 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41d429b099904a530f5dc4dfdd4724b7b6160c1de1330e0b103e8b8e3c737dfd The package is one of approximately 100 identically-named-pattern publishes from an automated bulk-publish operation. The tarball ships...

MAL-2025-187694 Malicious code in kinetic-paleoclimatology-holography-tailwindcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 967a55f1f97c9bb48caabe10483190fb7f9c204de61b96cf1f01134cf561b309 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in adonis-comet-sedna-geomorphology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 337bca060b6e0e2d205280cca27089440473dfbf815ca59cb70305a3995b1f2f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187229 Malicious code in grep-fire-throw-web-sed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebf7689d3d15f023a0d962a1dc51e8ad684feb14bbc8cc9a82f6b8716822f137 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-190079 Malicious code in update-proxima-isostasy-archaeometry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ac93addf5705ec6be9762a965b872ca031400f21168925e440d5142383746b3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189439 Malicious code in semantic-release-boson-lepton-kastra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdb5355d7a6caf4ed4524b31f706aedd024df4b09ee0659e35613815b8d89df7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in imodiov-kugfi-comoai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 640f7213106412e8478a92243f16038b2531d6948bb0bf16a02d81bb61b1a257 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in one-kat-idav (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a646024d841c9ae435d0f3a04dc72292006f5590e1875ddbbdc80142ffa849bd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-lovusa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ab67aa5db00c9fd7ed9e62f2db7878dd9931879f8c814bd6eb2e235c8d1665e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in goodaan-ngafsa-naufguabaif (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05388cbc735dc35739f1199c971384869858d2943b7686be3c8d55cd35a7755d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rintono-poke97 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3218dedf12c474433b6330dc36bd3190d694ec554211987d8713d5cb80f5c274 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kapvino-samavu-idabi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83686869ef1c773c0c25890206fb5e1e859fedf64b81aa86a9336b6a25d29923 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fauzankusuma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21d74450deb29b4b64537501598c74280d637da67549ebc2133b18a29d069a7f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nabuf-oguuof-dusuaf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 845e03fa8400fc7e19c25ce1584dd923da4ea1a24a38403039fb5b3cb13256e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aiboa-mioloipe-ag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d161bac7bedcbe293b2cd6e4de648375252401b51451e03e4e4bc22103590b7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rino-poke24 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d6aadc653fadb0e1a861b9d8ad425ec9b28e3137554bc3b4e05c78260135aa7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-169545 Malicious code in uaragifa-mar-saft (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 765f102b8accf2296b6d7aa8b49c97215e7c1111f7f8293aa1d134aac0dd269a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-165077 Malicious code in rival-poke9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c28c14e60d33bf5c6290e506df829b042365a9e97d809f8d78028f997d04cfb9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nokire-nana10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a836a2533c19c15513f0dae7298e54b8bd28eb9108039a8a4bc66c08c71367ef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...