MAL-2025-140789 Malicious code in cli-charon-hyperion-flare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5ef2f2d089a90c3c3b1dde64cf335631b185d51d318006a25ec5fb1376e7a14 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146931 Malicious code in quark-oberon-cypress-charon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc7a7a95f173567a7db152fdb4d4110a7c2c5b984a40dd6540fa15a585c04358 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142480 Malicious code in figures-protractor-changelog-fusion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6927adefae2b36f27f179178319310ec17e61ada0fa07dde6c9c2c00d2085a7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141486 Malicious code in dagda-server-writable-gacrux (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae875b5316c762804cbf34948832e6ac8d9e8e240e5ae1343644ef305b5fd088 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139164 Malicious code in acamar-arcturus-procyon-csv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 430f2f98ef09397343911706356e3ab2a57ef203f1bcd2117eaed211f0369b72 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143967 Malicious code in json-centaurus-yakutsk-comet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf37872579d57c7904980d46accf7a399584cfd1c2f943c8c74688895d68442d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147216 Malicious code in release-it-apollo-cypress-oberon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ecddcbbf0f8099a1e391649b9d7c16f1ea8c65a436a1d4c333e454880358d06 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145124 Malicious code in mongodb-cz-conventional-changelog-ora-tethys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb147bfe801c54e943c3b384907f9f9185d5f7082e95835e37acd74d015cfb86 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hapi-antd-dione-xo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75ba1fa7ad9b95e2d278e65f7fd0570ddd801f915a2455530317272b4893438e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in auth0-bellatrix-orbit-eris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector beed952ff5c447276e9850d9f01f562419a7b51dff21a62f1a8668d20d516965 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in convict-pavo-kaus-redis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87dedd338de94ab3aca08a7d7afb89baa6958507406e3a7ae194da178bea1971 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in procyon-element-ui-uninstall-less (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5c9482de78b8db351be096255e8d470475ac1af6f9f421925c5db2d0e149ddd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in juno-pegasus-pegasus-meteor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 818102e2d582bdb36b85162b7b70ce1601669eda16d16fde3bc826021de287b3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bootes-browserify-browserify-elara (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5019fb52ca32d108a8a468f4c801ce7877677ed203ac920a136aadcd3625da08 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in webpack-vuetify-prompts-xanadu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc205f3c39b95556edfd8a57a59164599cc6c819582fc203fc01257b8ac60259 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chai-pegasus-janus-dactyl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f22985f2d8877c984e1d165dd6767a367d4f5c8488e58828bd17fdbb35bdb2d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in procyon-kastra-jwt-css-minimizer-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27adb475c01b655934995cdcafe5af454454fbd4beeed4ca694c1c812cbac919 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in non-blocking-hapi-less-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 075caf1674ff7e833f0bceb57dab4fd4abd685e881659c5f95b4ac57f926a0e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in local-odin-sync-public (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9d6eaad6abfc7da0b2db8e0aa9cb3812e19c577a9687e15a1f993dc96e8488b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prettier-plugin-markdown-winston-phenomic-airbnb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b4281d2293ceb3511efadd83180a51398ec38deb67e510f1ee4384129802f38 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...