Malicious code in firebase-selenology-blitz-eleventy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ba84248994554254847bbbe7d4d7c2dffadaba57bdad95b53540b7220944baa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in deneb-juno-telesto-shelljs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33bae7e16402e2f9c25bdb4393c7c91edbd242e3766f9626e46b527e7e400a2f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in grus-superposition-pegasus-antd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dad58e646a9599b1bc74e3e52f19631059b4d22a2879e23b3516e4ff029e303d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sagitta-frontend-eslint-config-cors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c2500c73f9e15b142f13f572a687f151b1f6a8e3eb54fb96cbd58ce242f02f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188690 Malicious code in photon-transhumanism-cosmicray-neptune (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88b6074683fa16520e5fd63fcb6e27cbd091b49c4588f9809e04d8af25c35823 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Parse Server allows public `explain` queries which may expose sensitive database performance information and schema details

Impact The MongoDB explain method provides detailed information about query execution plans, including index usage, collection scanning behavior, and performance metrics. Parse Server permits any client to execute explain queries without requiring the master key. This exposes: - Database schema...

GHSA-7CX5-254X-CGRQ Parse Server allows public `explain` queries which may expose sensitive database performance information and schema details

Impact The MongoDB explain method provides detailed information about query execution plans, including index usage, collection scanning behavior, and performance metrics. Parse Server permits any client to execute explain queries without requiring the master key. This exposes: - Database schema...

Malicious code in modiov-kilan-avumanaiab (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db629712d0c323f05362f626b330c7e855c18ced48ad453b34063bb77aeab07a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-oig-tmoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d4a649186286dab822f4ad87dd6845317574606d6d66a4406e72363dcf08f6e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-licki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f25ff3421cf3a2c29bbbe4e178a02aeb852bf2f6f952278fc77d4e13fa0a20a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in messi-ata-fuf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f9180d65291e2127f34b75e4df2fdbc020b802c0b1f9eafe36cf126e9e65a30 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in syahmuda-poke7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 327ded663f2d9a4e14d2bb45206d05ff9acc1f15b8cf143618a29f0b53e863ab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ma-rasaaya-nurses (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb38a83e5a36ceb61bf8cebbdb056ebf8e0d4000d123a3c28b6d0c6331ad6e9a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-166946 Malicious code in teagood-lokika78 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c108d2966622454fc1ff68a72f671e304e8da64c0c7f0f445afad3334fd97095 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-157377 Malicious code in kamasada-nuyata-budad (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 562964addf165933282cebbe5b8c4e3c5dfab2d49a2aead6d46fd3d985de1420 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in icha-72 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d216b393b30896cfced549c6d422ccdee83bbabaa52b184c68c38206df12c86 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

BIT-PARSE-2025-64502 Parse Server allows public `explain` queries which may expose sensitive database performance information and schema details

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. The MongoDB explain method provides detailed information about query execution plans, including index usage, collection scanning behavior, and performance metrics. Prior to version 8.5.0, Parse...

Malicious code in betelgeuse-betelgeuse-cassini-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1de30e4d515c90c8d81f0aee56858ae6df343a3a02ddf287cc29b3b20c1380a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138878 Malicious code in modern-cyan-condor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b19fbb2801752b03d483f9540b0ce95aa3b83204d042ccf9d3da684df398a418 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in umi-gaplek22-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b011c438a08f1d0510f78ea46a6838f41c636cf3fb7c9f88779d41e61f31a198 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...