MAL-2025-148158 Malicious code in spica-css-loader-testcafe-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36597f416ec7c190e827446bd569c4ad103c21ea45306506b1fa9419bb85a499 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146479 Malicious code in prettier-plugin-markdown-concurrently-helmet-carina (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01220b55cbcc05145bde2d9bc7588c46bd85939bb8352243e4cbd41f629045a9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147487 Malicious code in rocket-yaml-vortex-rollup-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d811a92aad91f2044cc7af5650b6330b10cfc7c3804ddd909e5bd7a1853b517 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146526 Malicious code in prettier-xanthus-mira-polaris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c84a4a84f5c6957d09542a7fbcfa103162352aa4cb119d5508f2321327c232bb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mini-css-extract-plugin-meteor-private-thuban (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7211b4171953c4e9f79f3fe9e5a6d0d27eb0cb456b57238fa36191cf3f046f22 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in private-readable-quantum-triton (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18d8a82e61512f1a6df2bf946c62cb03f61f7c4af249332fcdbef2b6f9f19af1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spectron-regulus-superagent-rollup-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdc13f76788773d5d2e87dd70334fb448f2b74ba088626599ff5a7c8a2cf7481 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149348 Malicious code in webdriver-mocha-geckodriver-alphard-spica (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 424af51b3129b7f488560fc79efa78acbfe2a6acedce4e79dde2a31d03191a00 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in node-sass-duplex-tailwindcss-dione (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7098a9772364fd84bff79ed48301a9ad9dd64fadccc0f0ed96c62347ec867551 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in restart-registry-proxima-hexo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ec56fe69eb0221d54ba68935b5267e8c0878e966365c32ddee036056e961c4b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in shelljs-luna-sadr-wezen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16462d0ef7a890863b7fa94c464a2b54c651b156d14de9f454999771ad47d84d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141232 Malicious code in cressida-ganymede-firebase-google (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb71ee957d87735cb80b3b5cb9e0599b90d70af44d94f738a88ef243bedd5e00 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139934 Malicious code in bellatrix-dorado-halley-sagitta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bd77d58a1e5eb06d335b824c723bba81e37cef46ddefa88e94c9bd1ef938523 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in npm-europa-cluster-postgres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18a563a155a4fcc5190b127922618b5c189c218e5ce7e7be368f7fee7d1668e8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149318 Malicious code in webdriver-manager-fetch-epimetheus-dactyl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f80104e90fd19f09841b6626aaa8cbe13df52164d7956580530aabff25a1caaa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140677 Malicious code in changelog-pino-pretty-webpack-bellatrix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9d6638b975900b50323b6e5574a6f9015943249473e10e8dd1479c4597b329c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142620 Malicious code in fornax-fomalhaut-forever-ursa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97181f8fb9f738f11f4c8c0ffc05468f3f7559bfba7aabd1285be7e7ae7db103 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139323 Malicious code in alphard-express-pulsar-schema (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfe342497592d9aebcac597ddb7000c2a6548ce707730f2dcc2279c5cdf0f22d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145905 Malicious code in orbit-delphinus-convict-antd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a8c21db0ca3c2e3cdca7740c7b7694a527a0fa3c519ff73b575f380f1740876 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148372 Malicious code in superagent-build-eris-inquirer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 906ce772c225466bc53a40615b5f32b6037636043160eb815b1653bf3675135e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...