MAL-2025-147064 Malicious code in react-bootstrap-loopback-acamar-csrf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e2204866b46af08416e01189305d8a67fe4cf159732b41f5e52e84a51b67bfa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in callisto-koa-passport-init (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0618017da8555c11693d63a92fb08bd79ee8b5a12fa2199727a8fbca59b2c45 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cluster-dynamo-morgan-radiant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d84da019afb622dfa09353a9c9711f4741db22e7ebeb3f066c21ec53ba3faec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in procyon-wezen-html-webpack-plugin-wezen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67b5af772803ada032750ec3f8403347e7a424e0ea7df55a1c9aadd26abc0e2a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in package-bunyan-uninstall-gridsome (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 927e4554a71f66a6a4f439906cade05f79691db231a52561db5eb5d1eff4627d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in equinox-playwright-xenos-solis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cc5f310b893a67c3d52cbcbf20c0fbf6d4ba00816213bf8a73618b3556d2d43 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hercules-less-elektra-hugo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7113289ee85e9f5d55f5fd301260d14823c26ffd054923a793191ee7fe7d087 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dotenv-safe-gemini-spica-materialize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d90a21326b456e45374854954b0fa67cbaa4f70120bb594b30d8ad762c87e9a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cli-vuepress-html-webpack-plugin-eris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c2432237f1723a37335764ec0a92fa5b96656aaf81ad501680076a8e1b4d646 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in antares-vega-electron-achernar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 040d240576965aed13ed11371c55ee7e2365e2d115a89b45043d3337d7d15156 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in postgres-zenith-gatsby-reveal-md (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f848a04c62462ebd013014e94dcd21fad1daa9a9bf0195d04d8e99c9c335dde0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sadr-jest-await-elektra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f8f94094428f0a2150123a27e6aaa31f5343d172db32867c1deedd1ffd7de9f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in electron-builder-optimize-css-assets-webpack-plugin-betelgeuse-css-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b7777d64a1343f42e8f80d8f8f3cde9e71dd74d38f9850534c9214756d79df7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143180 Malicious code in hapi-cordelia-nightwatch-radiant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13468034b470d0d147c580c9399b008752ad04b2ce9f400acd324b01b03c9a60 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139225 Malicious code in aether-buffer-uglify-js-pulsar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6228be0503c0333dded0d4c2cf95ac4fb6da09d2639f6c0abe9020cb4ea23d1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149172 Malicious code in virgo-toml-passport-altair (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 584f8b619a6b42d51e3495d518d1c3de32ee362ccd4c539987a484b1f3711094 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148323 Malicious code in stream-lint-magellan-dependencies (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcd7ba78ae6ff950c86e95dd3e3febac32c90c13ee98faa58fd9ae9d974af8cf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143807 Malicious code in janus-enceladus-pipe-carina (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8a25992dd1c02c8977257ad532c3234d6901dd4bd7ba8c9a29b1b02e1f0da2a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cosmiconfig-await-cressida-inquirer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bd2568a507aef1951ff5eedd43bdd5b0ec74acef3c09457d804ff29fed8d97e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in carina-loopback-zenith-socketio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a938276cf14613f10aa6d135009c7b24f7fb2e652a0db5c52685da55ce264972 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...