MAL-2025-147825 Malicious code in semantic-release-fornax-xerxes-command (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccde657a05676a3e3b9f919622689ae943a012f86450f132569c5866c8e60b78 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140665 Malicious code in changelog-concurrently-sync-antares (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5f1d4255bab5218283efc53533fb42513bd2f9d95209efc16d5763e7e8f24ba This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148900 Malicious code in ultra-less-bulma-bulma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fbe8e09124fc0caecfd47bbc91cb65955ecf81b13e15dc173f1d939c9e620e7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140939 Malicious code in commitizen-rimraf-figures-phoebe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66aae2714021dd118c8ba366f6b6870e5c1419b5ba2ac2523986e777b5c22445 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146934 Malicious code in quark-process-schema-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eaec4fe47aea0991145f9198831818cd8927acd7ff0779d6a8a4553a3b0018f5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in stop-zenith-auriga-dotenv-parse-variables (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 774ad1faf3276b16e95b19b4ded1237a9ae68be920fcb594731cbca811253b88 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in selenium-nuxtjs-upgrade-prettier-stylelint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 964a1667e019874b43abb7713d4776387e56a594b698432319c188f692097c2d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cache-ophiuchus-node-config-browserify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0b0d81771865bb974c560ebcce579067abe56418b4aab7d7db4414d5caf5ac0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in registry-concurrently-hercules-docusaurus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3a3ca3e3f6a93be7a3b7c1f73be13aa079cbd8125e49441cdda0d0fbe78b212 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in meissa-async-meissa-perseus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 873b499bb8e3a912398350cdd8e55638214ddd9feea30efe08c7940413b2bdfe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nashira-fetch-cressida-private (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99f86b96208f69b0e6e8c4f0832ea94f5eb903f45afd4f8c34dccb3a6a079114 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hapi-impulse-dotenv-parse-variables-prettier-plugin-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47665784ad522eb04cacf6b2f03e8ae0ac57786dd4012aa6cff0c9b286a13ecc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in quantum-promise-phoenix-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83997c7f595e58fc0c9df6d3ab102a43b0ac4c98f777de56bcb403d0b92d078a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cassini-mensa-kastra-loopback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3159ca473ca3810c1e97cd5748be5958ae8417f1f88bf30e7e1f6f1ada5d4caf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in warp-callisto-library-phoebe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30970dd99405b0fed1c24b38ff81cc49d20d1d6fa08cc6823785173984de12cf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in materialize-celeste-eridanus-aldebaran (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d702a92f89ce951ed0dd9e020041f48c12217dd201c89f2cabf03056e73fae3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in release-it-quark-antd-meteor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86314711951e058560cda1b445646d8c02da1a3a08066a8e8f749f38c1c95e6d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in commitlint-config-angular-commitlint-config-angular-solis-cordelia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bb3f567bb082a9917a4e38dbb29310a4010b6d8c0b2d6a2016a2ee5698ad2f6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in stop-bellatrix-sequelize-dotenv-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5f95ec2b2a6ea8e1d2f211242daea24e2ee014d180e06f0bcf4dd320bfa5b1d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fornax-gulp-cross-env-miranda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0116f63d9e00fd8d009e592db933a26fd7559ef2ec9933865bcdcc325f20b70b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...