MAL-2025-143786 Malicious code in jabbah-odin-castor-lynx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e305501ec1d001acbb239d5dd7c8b27592441584f5b792582fb454d30a2db986 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147108 Malicious code in redis-leda-cluster-transport (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72f45d2fe6adf84fd0c2f42c793eb96d05298d3426eb60758303b4494bb90a66 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144333 Malicious code in less-loader-stream-publish-aurora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b87848632542c547d5ecef043ccf837f25736a226b95c2f670c701032a0ebabe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144979 Malicious code in mini-css-extract-plugin-lint-websockets-polaris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9df9a852aa961ebef5422f98149751806926e48acc63e5492d955d70b7dcc361 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140755 Malicious code in child-process-registry-chai-nashira (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5d5e0a4c75e7e750b51f9106f6d21cbf53719ee3b880b06dc02013b87e745c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in publish-shelljs-hexo-css-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca528f5126e9c24a6c62f286d8690488cb572f3f41632364e361ae06bedbaaa9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in titan-fork-centaurus-fornax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f1852f1c60fd756f9680f7687b62b5f8b5fe73c9b92121a04e655bab2524630 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in less-loader-centauri-subscription-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea8358fbb12d3db96e025bbe6eda5a0ccc017c35f9a7f8dfc51a6dce33f9cd71 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in levels-warp-mongodb-slides (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f06ae7d6ff6aabf0154b5632ee77933718e1f2d084a2c285b9fb72e9b2dcdbac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in magellan-karma-barnard-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e688dc4b727f9d3b19915afd16b27657a3e39c2f63118c5d13e778f5826283d1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in puppeteer-prettier-plugin-markdown-loop-iota (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c09e89a9ea92244153433e928b97428ee04b1a431d3f3fa32f58050b91df40af This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in parcel-mensa-vuetify-proxima (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfdaae7c1522c825d5fc88e7dee72b39025eedf7b9ba29e41812384ecb3969fc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mongoose-prompts-spectron-lint-staged (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 664e602c1c1f17845de88222beb490ff65a987dcab2ecaa0d720d4c748d9beae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in webdriver-mocha-deneb-transform-karma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 150ea790515c59425cfe2071317b21fe51c70785ca2b2d6723de40588ca26b8a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in terser-jsonp-version-uninstall (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 963e0198be8f4f3709c563091335404fb9386697b48f792e40d1e4ab20e22401 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fornax-grunt-zephyr-bunyan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5618c03ace1b7982597f2237ad3ce62c1e20dfc2b23419fe11450d9d6f70b7d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spawn-nuxtjs-titan-public (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec0468752161bd7b872f33e88c5830b928b3ee82de8bc1436754100a420e88f1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in socketio-rollup-plugin-vuetify-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b25cfe748bbdae6caba66a493bc7b808107e36ada1c4f2a6279623281fcff361 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in event-deimos-mini-css-extract-plugin-mira (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10ae3339de31987245b0464e66994d4f5c09550d0710bd98c8ce08bb3c24c76d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bunyan-heka-spawn-json (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3db5614c01d3e27e5f9eea4ed9ba6041855f567bcb63abe84b582e58f8116e2f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...