MAL-2025-142208 Malicious code in eslint-config-query-cosmiconfig-kastra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3d4f67a49c2f8660c00eb78d5b0cd0ee38842af3b08524b54732d34fb48df93 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140195 Malicious code in build-unuk-uglify-js-configstore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33b7151233cdb9ba8fac2fc89070d32d847bc28c6e628851f6fa934f6b3ebefb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140496 Malicious code in castor-spinner-async-pulsar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60a7ffb45dc2db3ff1f356c7e393e67f1de1d339af5165815c7bc65a9702f209 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144222 Malicious code in kronos-library-jasmine-spectron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e649f5132815d972e00153417bb9efce79e604707867914d1eb4c868e30046da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in arcturus-proxima-cosmiconfig-websockets (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad310face776321398b0f37422c8df1b5a6ffe9fee76b8373b390f3511ff0195 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bootes-nestjs-heka-gridsome (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d4b4f01f46a46db96df07924ef3f869689ca6569af12e3d03bf1c55fd5e9340 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bulma-achernar-babel-bulma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 216ae8f8602dbed565afeda662df33d3b107653d5903360708f4ba454d0ecc85 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bulma-middleware-procyon-buffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2da90094f5a03de39c5fd357369364e0b32f35ff16c2eb61f23441b9e23f3d8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in materialize-cache-socketio-eleventy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6c505c1c3681aabfe81be57a2886297ccbb2901fd0260f10d2ec586bc0c95f8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nightwatch-figures-postcss-gacrux (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5684f253471f3ad92faf82be19ae9e11bcc466730f601e3572e2e65b93347e4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in node-config-pulsar-google-weywot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69a6c861bd6e9c076a17982609b8089b529c3b1811d9a9c3830b0c0b2bd92d18 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pegasus-grus-fomalhaut-weywot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bd88392d2ae94b49bc5758565080c4fbdd4026c05543b645b2d954d03994031 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spectron-node-config-prettier-selenium (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38125f8865078f53318f1d7935b87aad45c4b1dda28e2906a20fdb84ff3cf22b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sqlite-iota-passport-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3344171a165d0c3e2a68c971568f883679677b8f5082569c0d17202313d2518d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sqlite-typeorm-fusion-terser-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93f84983ab73c9eea07dd2f6ad3e21269897e93ae04d3867139b5be6736fb55a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in stream-mysql-typeorm-halley (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35405c74b80b740ff6692a59b7390e4f6533a8de1753a6bc8b734da445044bb9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in proxima-mdx-hugo-draco (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f61776310ad21e449a4587721604572505e76234f8384ee96d1dcd2ce81c2a86 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mini-css-extract-plugin-cli-quasar-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fab84b007bf18d2be53f34e9459eef3ed9c6f3df11ecedfddf8cb18bb4da19a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in changelog-upgrade-native-phoebe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d985c3ae2349fb80095178ca8c1c3d0e0171ce3f14382f0bb8265bbfd705918e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in apollo-mocha-atlas-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fd2746d873666f4365b41ed0fc9271d71a3480d6f86e815799cf9954bfa49b6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...