MAL-2025-170561 Malicious code in wulan-36 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 824d99b828ae275d75ea74acde2a97f34c6966c205cec9279f0ef591ad5abdec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-156643 Malicious code in inufgi-gota-jamana (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2290e77f0b677e85ff72ea7401cf01ad6fa41a56cb1db3089a7484b21b054318 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-150009 Malicious code in @mipta1/ersisus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c95f24e1ebc2262be2083b7ba6b758ada6c9c312157c197437f9c5c8fbdabfe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cluster-ignite-ganymede-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14437d0aefae1e385cdcb8120bc09283f513bed896c77b0dbe800c278ed0f2d9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in toml-jovian-non-blocking-weywot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51f63cdbda71e6348e3fa77a13ab444871e387aa663565f05d8a08312ad11fd1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fond-copper-platypus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 679bc3f0be0d096c7197b95397a01d24f75767f4a40dd4f33a5d2d564a929856 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prepared-beige-prawn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44a7795dec554714ee6d12138c4b61dc1eedb909e572d48fa3de60066f609362 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Rarlab WinRAR 安全漏洞

Rarlab WinRAR is a file compression/decompression software from Rarlab. A security vulnerability exists in Rarlab WinRAR version 7.11, which originates from cross-site scripting in the Generate Report function and could lead to the disclosure of user information...

CVE-2025-52331

A Cross-site scripting (XSS) vulnerability exists in the generate report functionality of Rarlab WinRAR 7.11 . The root cause is the inclusion of archived file names in the HTML report without proper validation, which allows for the injection of malicious HTML tags. Successful exploitation requir...

CVE-2025-52331: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the generate report functionality in Rarlab WinRAR 7.11, allows attackers to disclose user information such as the computer username, generated report directory, and IP address. The generate report command includes archived file names without validation i...

PT-2025-46677

Name of the Vulnerable Software and Affected Versions WinRAR version 7.11 Description A cross-site scripting XSS issue exists in the generate report functionality. This allows attackers to potentially disclose user information, including the computer username, generated report directory, and IP...

CVE-2025-12113: Missing Authorization

The Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the atgaideleteapikey function in all versions up to, and including, 1.8.3. This makes it possible for authenticated...

CVE-2025-52331

Cross-site scripting XSS vulnerability in the generate report functionality in Rarlab WinRAR 7.11, allows attackers to disclose user information such as the computer username, generated report directory, and IP address. The generate report command includes archived file names without validation i...

Malicious code in putri-bika14-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9004aaccee21934fee12362c3ba8e9a0c6b86c153ae6f5197a971f480d74142d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138515 Malicious code in zesty_armadillo_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba71d65c17f09bd483755a349822375ab78248de3b4c9e9b81262ea343dd4798 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-133155 Malicious code in erick-rangginang14-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fff7cd51f259c429462d09911fa613cd8f04dc3c0e030cae78d53cc5d295fd8b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-133611 Malicious code in fundamental_tahr_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bce4b3c14679aa7753a222e2d7b420081c35680caedc69b83e0808b01d78770b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cindy-ruwet97-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf2f38472e93b7a8e268de2328d19d2aecd689ca4792742060b6d3f194e6f84a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in oral_eel_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3487c7acadce833e59256a1ad2b71a9bb8868a6425f7e443a21ea22b6aab32bc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in utomo-ragi61-wekto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c6fcaeebd2d0ed3b4c93ce77c1c56cf87901a8bf64d96899d6f93771ab535fc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...