EUVD-2025-176492

Malicious code in scripts-apex-gravity-jest npm...

Malicious code in geomorphology-fermion-aquarius-oscillation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a5dd8df67636856b60e86272fa741e198eaece85c5f95e6c79aa5e1235b8541 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in toml-csrf-quark-geodynamo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3982dbf209ee7d6c85aa17c309ca25a440c04ba6066aa91726691826108aebb5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vega-xerxes-meissa-chalk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b63abf6534ea99f2d7edbd9fec922e534d5a525a6f21b8ba75ad9525c2a485d8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in markdown-pdf-jsonp-brane-cross-env (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f0417489b7dc888c7fc76f992a2402c4898362ade16a1783e26a8ac2de36a5a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in supernova-dysonswarm-arcturus-solis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb56d71359f955d83f68c2050ffd9f7e52a84eaca18c226afd9b2e5225844e19 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in proxy-meta-pi-theta-bad (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d262f7cb74cbc02a73246c1079e373c3cf5e367f400f9dcfb0c987786b01dc3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in version-sass-loader-webpack-quantum-computing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 245ef4ee7065bdec8a11c9aee3fc8b289af5ac01fda869072a7d09d22217380b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in perseus-selenium-lepton-ganymede (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9bfc1cfbb199ea1ca3bb90c697618a7d74ab51f4a88a59c1319771b74755a06 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in meissa-pavo-asthenosphere-aurora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c245ebc6d662cd2d791c2a665a08b64c0ac325a3faea4ed570146f511d921147 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bad-eta-encrypt-error-signal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1430a541231c581ecaecf6111ee0646d539ec2f560fe6401ba786567cbe1eef2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in user-refactor-cluster-transpile-eta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f18892cb120efd30e52630d809cf1105bfccbab7aaa211fe691e458990281176 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mira-wolf-prompts-got (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bde8f3e3019d1490a0c886c455ef3b5c6532daa56f5ab4b1b118ae0302331f78 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in signal-authenticate-cluster-await-byte (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a9c4b67b3adc6ae2f52304f08d24dafce84d84d9f5fa1ccbc8017c2dc638b4e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in version-meteor-jupiter-chariklo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8de3b988f0f3fb1fd2117a656b4e08db5bb4f37c268c474f1d899daeeacaa701 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in photon-sedna-hugo-palynology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 691a529c360565b158507994620e6f1f9da55fab5873d69b8bacdc29bc0b557f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in refactor-psi-xml-cold-sed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49df62b681f38d14d73246fbf7abeff09d01a5362d99320220c285c35bd561e7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in terser-webpack-plugin-delphinus-membrane-cryovolcano (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83f1fbd056f464401107ffa949a75c56dc9110b1b201fa564b844e813212402a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in notify-zero-abstract-old-dog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a53282b311726aa389d4f18e04f8cdede5fd23b6a0f0f816a5e9547530a4e8c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in castor-magellan-halley-equinox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f91c2d58b576b6b398598b006ff7330ccf27b074f3ba12ea2377ed20fee56b1f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...