MAL-2025-139761 Malicious code in avior-apollo-oauth-dependencies (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b1b3417cb0939af2d7ef1ffe7ef71b3fc5def7e905d096c43f0169cd5108118 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140195 Malicious code in build-unuk-uglify-js-configstore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33b7151233cdb9ba8fac2fc89070d32d847bc28c6e628851f6fa934f6b3ebefb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147254 Malicious code in remark-meteor-slides-kaus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1db4f750a0eb590c31e0a9400a047a1df8bbb6e37335e96c282103d3ef23085f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139305 Malicious code in algol-prompts-meissa-karma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7444d1efb910638a58715c22822c78fba1ee61e841b95a0f0f846fd5a6529fd3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148724 Malicious code in toml-uninstall-acamar-juno (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b3712e1a9327cc0b6123842ab0d3fd495b50d3e0e9e098c7eeaf5593e748799 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hermes-css-minimizer-webpack-plugin-local-request (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e2c81158c907717901718ca894e86e52cd0ff7bb06409578ce68b8cd5a40ca4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vuetify-delphinus-rigel-helmet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d92fadb7b85c2e89b10089a57a32deeafbd27adb0fc4983fa35668d33e523531 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144265 Malicious code in leda-dependencies-fomalhaut-rocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54ae827852ca50c8b8261e018186531b500df684686ce65d1fcc9aac58119916 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146465 Malicious code in prettier-dione-hyperion-auriga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 650be6585d50ddca2685469d48a1b170c812e5febbd8efaf74b86549b042f005 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141996 Malicious code in eleventy-envconfig-xml-private (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43b303cfab127f5de13e9ddbdc9cfbd359b52b49413136ffa41fc2ce9ad4d257 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140043 Malicious code in blitz-enceladus-hercules-spica (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec1022fc591bd1810eb1036d69e7ab5a393379a1d263acf2197b0e74d2956afd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in uglify-js-eslint-callisto-meissa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03565cf035b694081bdb901d1a0031e7f748cf875b1c80f18cdad66698f38aba This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xanadu-loopback-enif-ariel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91b262f3dda7c4c884473fc437198ad7e57eb99f347ca9809993ad238590768e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xenon-oauth-framework-stream (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21dce1782e99ecf2a9a1ac060d68897c127bf998539a101ddbcb4e03d4c4e560 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cross-env-semantic-ui-dependencies-europa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6332d430064a3f2838ee485b692085966c87a656a847987e105921afff07be4d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chai-procyon-postcss-loader-forever (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbb383055d39ccf72e511de623d5b1555ea9a47f86d90567d3f808175b6d3ed7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in venus-thuban-dione-reveal-md (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 888ad67153b6a753f31c031e3c5551906677bd3c5e5b020151ebc1bb704100e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in postgres-dione-helmet-chakra-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d34bc74442aa852ab5dcc44cd33954927ffeba159d2a166a11da6e369b77991 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jovian-auth0-apex-element-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c2832198d7eae378760f701bc5fa69386ff7a313e612cfee8431f5a623fa212 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in socketio-pavo-prettier-stylelint-global (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef069690a1512a2f00962ec60f16b54aebfe8dcef7955eb47bb0bc8bb4ee1b47 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...