MAL-2025-99247 Malicious code in aggregate_tyrannosaurus-appteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c25d15c8aae798fd9403420f7594acb611c704425712fbc543f2e2bdee11f11d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prior_gayal-appteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 308206b02604ad9105c180e88e091e8b1d97349e3dd59ba570595ff6e28a095c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in weak_cheetah_replicate_automation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bb7e2c7bf43fbe86831ca1e5e5fe1f52bdd5059ad9dad04d562a544f08d97aa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vicarious_reptile-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30d251b9f962e186c4e2336d9933206b5b2be81a0277e6fae52cefe295042036 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in graceful_slug-excellentdev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d771c67e37350ee332fce7243efd0edaf5ba5c8b25d70f102f0dc38f9e31ccbf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in literary_ox-appteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a452ac2bc83569378a7b2299e843f8ffd738ccb9e2117a6bcba2bf60663c67e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in necessary_echidna-smiletea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96ac83881e6e2cecf2c0fff680d00aa02e5c9534c628c583313fcb726a994132 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in slimy_eagle-biggestdev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9995c71084c23e2a26e695c8460ea4ea2194a2603edc60e4a6e363961d7e72d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prominent_duck-appteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7d5ebcd79e0f4456ba0c4f0a31e7ece36dda021043c54fb77e7ac87b181c3ce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in only_tiglon-notthedevs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6dea42e5cb70a8fff8955cde686f5d26943f6a8a7235f3241e2218a43f90f2b3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in curved_lungfish-silentdev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75ac4836b19aa400e1528e045cd3b06f48c837b83f1f22507cd4addd86e7c92f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in junior_tortoise-strongdev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dba17b5e876c1683166f4fa7b8beb0ae0ba506489c8f2b72d23055744008ad0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in negative_stingray-notthedev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffbee2fb813aa8ba8890b9c5061bd6dacea051eede9e2e705631235ef1fe5a26 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in variable_manatee-smiletea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 376985a9b75e8f9d90499f13a239df23e616b57fb0eda43812e83fb114a8fbfe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in severe_parakeet-appteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6677a12b29e83e16c7ce5b50c57718724a527f88369c308233750d39503e2163 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pannnini-notthedevs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5987626875800bedd975e2c57b8da4f867eeefe7416b137651718fab19d93190 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in upper_stoat-notthedev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd32a5758dd468261153c526719cdee4341fceec8452c92de4a317dace41c89f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rich_butterfly_replicate_automation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3e51c673fcb1da2a57af1439094ed66c2e2bf2edda317fe911b8fc25e8008df This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in unconscious_wasp-appteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db6b6b02608d586b59914122617c5b59ca15392b624025f4ea3482f305c9a3eb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ethical_wasp-smiletea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01cc95c9722d0910a8f4e161f7226487bb8f8c433559c79538c101c5da59d4d5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...