MAL-2025-137167 Malicious code in surya-serimuka52-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26d41428857a7da3874149232297c651ba7e598fa4346f3cf57b0cd756cfba3e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-136642 Malicious code in rifqi-kue70-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a43b2c994252b38eec75b9f5cf288e8ef3a697a4fd4cf299c8cbc5cb7c86f091 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wild_tiger_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66db14cbd757d35944bb0fad101f3241d42631a8079fc945c2e1ea13491e4464 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gilang-kue20-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a01689d9fc5427e17691829c94a293aff95315671abbed8d03314a2737ab0585 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hollow_meerkat_tan-52 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b25ef6078321eac0b90d7fc5ef1e30cc69e0e8fa5b1c8d2a7e9bee69c32112d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wati-gembus79-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1f317789c25a1c1a54fb28d7e5c6843577758bfab74e7fd6dbfa6064421a0e8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in iwan-enting81-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abb6520ecf1456431bbf7638dc8c3d29e63d0f92db23fbc5be0f49e5018ca8d8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tania-kue94-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a02044894ec841e16736eec94c2dd035140de07b0b701220210f0dcc82919bf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tiara-kolak76-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5513887abd87baf34d3d2ad35aeda9e97492c3058c7ae6a653f065d7c8e7f09f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-76071 Malicious code in vina-lepet76-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19e142f6f4bc6b1bbe7357240412648b128c4f26dd2dc06a53a87135bc1af38d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in direct-aqua-beetle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 226b422317ce0cebbebe29a8b64dee113a5d4ed8f6172cbfa31751f75b8eea17 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-62878 Malicious code in fadhil-kue76-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 208383e4d42950f0825386d7e42ece985aeff3d6ab3ba1ffc411f811652008c2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-66508 Malicious code in zul-gudeg68-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c38ea07072ea15606ce14aa6b661fdd622acc2c88eb339ac880593b95537038e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in yearning_locust_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e29d56b37d79d4af6001d682eba04b6bd8cc325b3b5445ef0134388bbca3376e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-60682 Malicious code in injured_wombat_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6434b66d1ef464d44be52f27c79ff7fb642cf81cc0356827238dd317e04c091d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in unexpected_hawk_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4959b585e00a798dda2733f2a49a7b60289174380a94c9c1f2fcf01c87d2f2f3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in laila-soto88-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 508429f2ac0255cbd19282d15a7e297d20ff2867b615baa070c763aadd8a5088 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-63783

A Broken Object Level Authorization BOLA vulnerability was discovered in the tRPC project mutation APIs update, delete, add/remove tag of the Onlook web application 0.2.32. The vulnerability exists because the API fails to verify the ownership or membership of the currently authenticated user for...

PT-2025-45466

Name of the Vulnerable Software and Affected Versions Onlook web application version 0.2.32 Description A Broken Object Level Authorization BOLA issue exists in the tRPC project mutation APIs update, delete, add/remove tag of the Onlook web application. The API does not properly validate if the...

CVE-2025-63783

A Broken Object Level Authorization BOLA vulnerability was discovered in the tRPC project mutation APIs update, delete, add/remove tag of the Onlook web application 0.2.32. The vulnerability exists because the API fails to verify the ownership or membership of the currently authenticated user for...