MAL-2025-86194 Malicious code in hadianto-dodol17-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b96bf6f6814099980dcd9e33c78ccaab79205a040bad0104795fad1163e2b5f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in whole_reptile_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 841b69b022dca1db354a29a3b606bcd7b4c58c22daeaedc65f5bf6f1f4cee5d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in indah-rangi90-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8df1ba4ac4415b21f91595cee12d26b0aaa53eba546955b27d292a09b47079a7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-11894

The Shelf Planner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several REST API endpoints in all versions up to, and including, 2.8.1. This makes it possible for unauthenticated attackers to modify several of the plugin's settings li...

Malicious code in lina-lepet72-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a57054635caad9d9dc621f1edc61f850afa8cf2571c840af55e51a0f27fb83d5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in qori-lontong82-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58731da5d51cf979f3b448a55b122c10758bcfb86ecc597877a2c8a1e60662e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-76970 Malicious code in bambang-teh12-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 539d326b8b78ce973c178cc72ea5a0ca1c8aab6799aa5209e0a4ff721ceaef42 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-81543 Malicious code in surya-rangi42-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b883cc588e04920f64b18145d8ecbfc3205be2bd672789aa0b3d8f7b69f735c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in biological_giraffe_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c5bcae5465976c24198ec96e10a138805724da6951ba3e9744235ab38a43ceb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ida-lepet22-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b80d52b52e11d5091f352ebab9b07587cd530c65947910ca59f3d6f656fbbae2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-76857 Malicious code in andi-tempe15-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2004d468fce32be558925096d8b6cfeafcc0a90a021b7d569983ef389911258b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12526 Private Google Calendars <= 20250811 - Missing Authorization to Authenticated (Subscriber+) Settings Reset

The Private Google Calendars plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pgcremove' action in all versions up to, and including, 20250811. This makes it possible for authenticated attackers, with Subscriber-level access and...

EUVD-2025-60994

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI provider.�This could further lead to disclosure or modification of information about the server. There i...

Malicious code in fauzi-mie73-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3034cf23f339f34d976064e5daf8a05350b66fe1456a5fa8419f89f41f64c04a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in umi-sate44-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b98216a8116e14baa1ad395cf668ced01e518d7863bed003809de9176d3c3f36 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gita-rawon72-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5bd550a90ff7685b8419d25973a30a96db888ffb6390c226ad81ccd03314f13 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in oktafian-lontong3-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9eebd19cd655d272703db8d554f1cac34b65160a3e055c2abc1a3cb081b3582f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lisa-martabak62-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d34d4ed0aef7959c15d53fb039cfaede7cb7710177a3665025f096703436b869 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in evil-coffee-dragonfly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ae3664e06efedba15e365b53fc802368b75cd727a341aef99f6cea2819bedb3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in weekly-copper-grouse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4331caae1eb3bea0eb7b19d037e2ba2e0218028f98298cad73e5db77e6c941d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...