Malicious code in xanadu-virgo-meteor-capella (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c761f603fa14ef1f4f2c2a192cb03b28359feca4a70d4e702e1fadd8d0c5e5e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in transport-ursa-lyra-yakutsk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89784435b215c5db5e4eb6a5d2aa6f1dcb7a376c23b852460333b436b548c6c3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sagitta-development-deneb-dotenv-parse-variables (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82414a4bc96098b86bd55579ab7fe398c1e9f770aae7802ddb2a096f2dbfea1f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hugo-neptune-mui-terser-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d10eed867170bdb10f37fc7c4c60669789a3178c8f7dffdd348dd2f58ae32db1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in norma-html-webpack-plugin-version-juno (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84509b5d35b1df7faaa56be4c99f921048932e5586fbdebf4d72f7c87eb39467 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in scorpius-puppeteer-gravity-webdriverio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a295c665cd756be249510160bcea8ff37c3445fbe45a423d3186e8403d9625f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in react-bootstrap-loopback-acamar-csrf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e2204866b46af08416e01189305d8a67fe4cf159732b41f5e52e84a51b67bfa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fornax-halley-antares-betelgeuse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8882d047d9a17c01abbde20487bac4f1b53a7334ed773cb36f7e45fd74913c97 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kinetic-antares-weywot-virgo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bff93183c6f42f2fb75cd6083a89b6b5d26427d278de47384359f61e64082ee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-umbra-duplex-proxima (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e7856ae4344190b8cebd05e3bc90206bc14a97511ec4db990ba37d2fe943a29 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nextjs-adonis-kastra-rollup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ec12e9d021d38f1396774e15aed3fc937841fe74ebd34c63516944c0f9a23f6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nightwatch-ophiuchus-html-webpack-plugin-resolvers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afd914900fc67827f00e07c2f5c5fcde3d709bb90a7146f51700c73d01e22125 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in equinox-hermes-farout-auriga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3361f0ac777170ccd3723923d498871e904a5eded9e7f011447fd9db27fa1445 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fusion-apollo-style-loader-envconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81e697bff033a44314f01620f35bf49c622e6ce1d0f971103c8b1871fda65d10 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in unuk-chariklo-pm2-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d0604709dce3ed5dd4f261490cbe3a807f323953a6b887a051e007ec364b2ce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cygnus-heka-mensa-hermes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42240a0951e6d568b6eb3c3c4ad953f7fbbfc1af556e22fa93ff5531099adbc5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fusion-cygnus-scripts-carina (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0da0f3ed82a6802e1032006ffa7496f3444868266e937a6df6c74d62d391362d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in superagent-nightwatch-got-arcturus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54e9aec448506ac282ea13c172e7921e650b5cd3001c93cb67df38d502291a05 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prettier-plugin-markdown-browserify-link-radiant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da1a8c727ac3b13bfebcaf88f918fb328f6db6db6c868976d5d5db78df819ad9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139763 Malicious code in avior-commitlint-config-angular-cypress-quark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a27fabc8b6619c335527c49d2b8fcb85fddd7995173052888ec6ff565c9fedff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...