MAL-2025-141733 Malicious code in dotenv-parse-variables-proxima-markdownlint-meteor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 913af6b808b2592fd435ba6659a92acd757d2e960ba9668aae34518b74dc98bd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139965 Malicious code in betelgeuse-andromeda-supervisor-solis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffe094e00627a2f06acaeae706de8a734ba3bd11e9d5d984ed80007cf1c261d3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148263 Malicious code in start-backend-delphinus-writable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56927550faff76fc83b82b8ee8c61abf5f4278b560fb1acc33b5f11b924971c1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dependencies-envconfig-bootes-postgres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c603800bbff9b6886548978ff6df941a13ca7f23109be574c0f203af1e116c31 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chai-antares-gravity-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78991cb9ff54d1247228b1af1b38ec21552073b5ade063b1ff9372b67c59ee8c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in triton-enif-rimraf-pino-pretty (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 078814d063e1653768ceab42e4895287f704be8738fa6ad5ada0a2f48c65cd4f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in reveal-md-fork-rehype-yakutsk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7bd2af128bab75e78effa18885ce78d40f2fe2aac43ad15b786c5fcb3399f83 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in javascript-indus-ceres-ophiuchus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 183d484945bde92944532e2b9af5c200b70e70bcd5879553d78a8deb2da8f18e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spawn-mensa-nestjs-mini-css-extract-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd4b5e325e2cfac082460dc57cfc4b2006f296c9dd1b3b9c7ab233de8f93398a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in enif-fusion-chariklo-chai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e99b8a29edbf68f38fa93c36114a7188b726f9e453a14c9ec6da28db44f7f94d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in inquirer-cli-hermes-commitizen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e24b115a829d16b3956d1bc125c8001900849f9d2adfba59701f7f3a09299ce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in less-loader-stream-apollo-impulse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d4c3f57d021643f309881fcfec23ca4ac61c886fc4619fcba72039358590d00 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in yakutsk-polaris-dotenv-safe-izar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a57e19ab1937184b42b470fef639f3354a1f7f637d15d6acba77b90c665a4194 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in command-xo-ariel-atlas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a366c080a4eaa2648f83bcb94435f3176e85614a052f24641242493394fa733 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in proxima-node-config-server-electron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27de1abef874cf3da3daa143496ccb15836fbb297490b54876df4e5a445ce103 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in canopus-kastra-arcturus-phoenix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ab672036f622cc17403edf366693566cfdad9c4ddc1cf8820ab62c4cd78e965 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in semantic-release-andromeda-cosmos-izar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f611642f70b9b59e5b31cd473fc4da2a70ca1bc8b7e5709014fc4619b1c9ee7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in titan-ganymede-cypress-testcafe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fd6e41a91413ea14979cf90c42cbe9942a3e2691daf8927c8158eef192882f3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rollup-eclipse-equinox-phoenix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 917d12da5b6ec2aea61ffdd55200ca99828c12b9cf613f2732780c089bff606e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141665 Malicious code in docusaurus-geckodriver-quasar-sedna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1278c2dfca36e408955a0cd7645142631b605c52598a462bd5b76cff84d45d78 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...