MAL-2025-92686 Malicious code in yuni-getas42-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c280bbe03a0803241f52d664df10255d2ce63ebab76aed121f8ff65dd7c2ff83 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rina-semur52-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc305bf59a0b8a1eac93efb18c286780da4df16fd97131601c26446c3eadadae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in super_lemur_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 470f83078d88a3a18fc651d95254ff064cbd487f96cf1cd7296fcc1c257a830d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-72918 Malicious code in fauzi-bubur70-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34f244424025bdc8c31f690f6b6aa9485bd5027772d597c9e7e87c45bfc7d601 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-74894 Malicious code in patria-kupat81-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ab2c8c4ea54da40c09953425a67e0148e1078482a6d64a9815f0f0366c51f27 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lazy-sapphire-cattle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 797c5ff62fe005596b7cdd6ca8c4de1f4e733bc7d0e68ca073824716267e48ae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in abstract-emerald-locust (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ba7c64cd23064df86ac9fd3f857ab0230e22217e554cb06cd3f105814b9adfa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-71480 Malicious code in vivacious-harlequin-bobolink (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 831b5de2e9e7abc01224fd588df7e23941dc986f7e24a44b16493dd7306f29a7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-69151 Malicious code in likely-amethyst-nightingale (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61539cf179a724bb0de54e901cdf3b06ecfb16207ffe4bbdcf0c601a66fe69c0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-70879 Malicious code in strict-fuchsia-dog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19f39f3857d93359409fa65e271fc63fd5e302393d10e8b6c829d5a4c3ada0be This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-69805 Malicious code in painful-plum-flamingo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 086023496572a3e9e6a529d343abce1623bcf1759063f3de65f389d728c610fc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sick_porpoise_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5abeab42cf71bd05870bc314de12fd4b578d7e0cbab2703e79f798329cb812ee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mulyono-miebogor54-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4f8e44f6163f8b5b9137d5dc0deddb5cfd2cafe6462bb51df286c468438f929 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-66526 Malicious code in zul-mieaceh89-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8ffb16d6edc65f56d445fc5e6e3b3c9ed48a9fec7c1e9b18aab8f87dafa409d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in arif-oncom52-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c3e607e72196f2eb06d76afddfe649af4cf9a2bab1733809e749674eecc3b25 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zaki-klipo56-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c083f7c8b54f925b1909a5ce62902e8c9f9a8698eea78f6715bfd14f2985dda7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rina-wajit82-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6a851d3aebb2df415e9634e5dcd5c69830c9b8bcd66d6d33bd0327d2550e25c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12644: Improper Neutralization of Input During Web Page Generation

The Nonaki – Drag and Drop Email Template builder and Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nonaki' shortcode in all versions up to, and including, 1.0.11. This is due to insufficient input sanitization and output escaping on user supplied custom...

CVE-2025-49145

Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, a user that has enough rights to create webhooks mostly administrators can drop the database. This is fixed in iTop 2.7.13 and 3.2.2 by verifying callback signature...

CVE-2025-49145

Combodo iTop vulnerability CVE-2025-49145 affects iTop versions prior to 2.7.13 and 3.2.2. A user with sufficient rights to create webhooks (typically administrators) can trigger database deletion due to unverified callback signatures. The issue is mitigated in iTop by upgrading to 2.7.13 or 3.2....