PT-2026-29505

Name of the Vulnerable Software and Affected Versions Joomla! versions prior to v2.18.0 Description A lack of input validation in the autoupdate server mechanism allows for arbitrary file deletion. Attackers can bypass input validation by supplying crafted file paths, potentially leading to the...

Improper Certificate Validation

org.codehaus.mevenide, netbeans is vulnerable to improper certificate validation. The vulnerability is due to the autoupdate system failing to validate SSL certificates and hostnames for HTTPS-based downloads, which allows an attacker to intercept and modify autoupdate packages and potentially...

MAL-2025-186869 Malicious code in europa-loglevel-levels-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector adb23e5f025e22619db0589bfdd3e0f01870534acb40e91b70a63bd6a2c90f08 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-184279 Malicious code in modiov-kian-avcaf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e7dcae918ceedd2393d86597d1eb7b34c627b289e772658069e48ef97cfcbb8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in miands-minst-vusd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e8087075390bedbee654c5121f2239308b4224955df98289952446bc4cd5469 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in polymera-anasri (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f230159a904a5c9908a33653eb5fcac3db22e5e68e2dab9e6c619b76fbc1ed4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in butry-mutyu-waegressur (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 641476f82799aaf1d10a93d30259c24d0eb40b69a6b28e8852ddb32c79b70539 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-169856 Malicious code in uinsu-lista-atumuna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65d81262425c8d0bcc29d338485b467d50f576bee587f1f169034afe4849c962 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-164438 Malicious code in polymedr-minus-buipenaj (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c7a77584754b0df1ed6551c159747189fd0a72a1576f7ad5d9fc8b69b263677 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-157490 Malicious code in kentung-11 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68e7d0030aea96a4bf934407d3cc7b11e6b90856b7ba8024bcc01c7f6fac0db0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in t4mp0p0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8533adbdab71fb930973ad0a4455ce8ab1c0bcaca1c83b958ededb1a3286bfa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-125904 Malicious code in disturbing_hedgehog_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7602a2ed8df2f2f27a82d54164a33c1a86ca3620fdc62933c481722bebe60715 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-113534 Malicious code in eka-nasi28-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb273f632d495afeed791fd6aae76ccf2037789323b2040f81617758c9271761 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-117638 Malicious code in umi-kupang99-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec013b84ea8c54c826181401819ab244cbaf559efc1afa7e01c0ae2e249ecd3d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-107932 Malicious code in resident_kite-apptea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0e0626eaab45b6fad715b8e901c16b17518a93b08d43bea04ed396764f65ae8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-104079 Malicious code in increased_zebra_0xrequest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4973fc9564be85b535adeae142fc5da481dd8341c350ef81f4c743d93febc22 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-78092 Malicious code in fajar-gado-gado96-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db11127eefe4aca6086d22b9f840d0cd35b4b0fb5947454b7329f1a96695306f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-74298 Malicious code in mahesa-nasisayur75-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 361f5e5bda0e26e3dc13325896abdc797240d5f6f9cbdb0cded67a642cb731e3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-62784 Malicious code in erick-serabi57-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8391f94e2641b7b8280e5486e597c3e5b320f143a41769874ce05305e228ccb0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-60495 Malicious code in following_felidae_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0241d6ed257c0269760c41b7fa0674a579be5026f4cd3d764369b1a7b6ff2ded This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...