MAL-2025-147826 Malicious code in semantic-release-google-warp-vuetify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector befc3050b341d286101261fec11b2cb358d3994e132344a3ffd96727445879e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140058 Malicious code in blitz-pulsar-bootes-dagda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f143c148c7e4c8e2bb84556a6a8e227304fefdc3d346c1b959bf9c04f6f75559 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146063 Malicious code in pegasus-vulcan-framework-pino (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f49c20d826fc3caba360e82a06dd11069ea8cb60d4ffcfa801f351b1e7f5717c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140200 Malicious code in bulma-achernar-babel-bulma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 216ae8f8602dbed565afeda662df33d3b107653d5903360708f4ba454d0ecc85 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141282 Malicious code in csrf-cressida-graphql-rest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f0f8102da823f1598bea95658a11ba091cd8ae0d45480aba1cafb8d24307920 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146831 Malicious code in pulsar-farout-pegasus-publish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 936458586d508d170d49bbd490dbb216acb183554cece11d629cd5fddeff09bf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147506 Malicious code in rollup-package-duplex-superagent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 821c407ff719dc4afe450356edd924866833272548005ebb50e5b1f4254670c0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147595 Malicious code in sagitta-europa-xerxes-relay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71b016074ca2bf81d31113e17620b1a0ae9d8d9e1abef97cc8f872badf16e6e1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142008 Malicious code in eleventy-nightwatch-tailwindcss-bellatrix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0154347a1de85eb8f3cfcc2d53c17da34e78c91e8d4ac0c14e7bace97e22ca9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145827 Malicious code in ophiuchus-metalsmith-apollo-fomalhaut (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80e7e51a83f23a65a177aa0973d2ad88d24a3da3dda667c7cf1f4228fbb52357 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145199 Malicious code in mui-cypress-blitz-cygnus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 991e983f3904a6d0ef9d7df604599d90c9d1225c9f60e4d425316250f0264ed1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142770 Malicious code in gacrux-hermes-mysql-meteor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 968c91bfa918d1b575481a21e04dc8ff86bc84701ba0de6aeff412ae75a289f9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145887 Malicious code in ora-jest-nodemon-levels (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 726bd6f462678ed62b14d8518574a76259ec9497d7eb5ddd9ff6de89b9f8dd22 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147014 Malicious code in radiant-equinox-pm2-restart (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dfdbb60037d98cb4076c74dcd46b2323884f2253eb379e85db9ad413affc169 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141004 Malicious code in concurrently-deimos-scorpius-kaus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 417930b3a430052e342e5f69a99cbf6ba77c60440316b9ce057c1d09105f7c73 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145986 Malicious code in passport-rate-limiter-cypress-rimraf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 681229ea7b3d9ec5cfef526efbe06dedeca6d8a377a88bc79cdb618ee17c45bc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12019

The Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image metadata in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions an...

Malicious code in near_owl_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae380128e7d87d2b82ad55d13198e6560306659f85226e358b62b95cecfbad44 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tasty_ostrich_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aba02bcf6bc040b83ba7e5e10df0a1bf19605012adf3ca501bb8edb7401b82ea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in smart-tan-jackal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6346393ce37cb8b00d5201fae5e8b195ce2de523c7d24b265a68e3f23021174e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...