PT-2026-86323

The Beaver Builder Plugin Starter Version plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'no results message' node preview Parameter in all versions up to, and including, 2.11.0.1 due to insufficient input sanitization and output escaping. This makes it possible for...

cm-cve-2025-67303-node

This repository does not have a README...

CVE-2026-85620

Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pgreadfile through FROM-clause syntax to read arbitrary files despite restricted-mode...

CLSA-2026-1788517165 TuxCare security update for node-sass (1 CVE)

TuxCare rebuilt node-sass to address 1 CVE. Fixed in 6.0.1-tuxcare.1...

Malicious code in dactyl-typeorm-chromedriver-node-config (npm)

Source: amazon-inspector 7e1eb8b5ce8209dc7c309094d610afd19f31e514fa1ca2302f459e5fd9c969a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in cz-conventional-changelog-geomorphology-node-config-cosmochemistry (npm)

The package cz-conventional-changelog-geomorphology-node-config-cosmochemistry was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in cypress-node-config-phoebe-framework (npm)

The package cypress-node-config-phoebe-framework was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in css-minimizer-webpack-plugin-virtualreality-ignite-node-sass (npm)

Source: amazon-inspector 47ba110c672d536891660dda1ec49413f5e7a6c719c9586868aac72f13acdad0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in css-loader-phenomic-phoebe-node-config (npm)

Source: amazon-inspector 07cd1ff25e1d1dab0ec49a40130c27cf086276094946c1578b49eb29788edac9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in cressida-cybernetics-rollup-plugin-node-sass (npm)

Source: amazon-inspector ae7b624253f4701adc0d6788e133d422ccba7de259ae6dc18a12697f8594e8e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in corvus-node-sass-delphinus-nightwatch (npm)

Source: amazon-inspector 469e07d52d72f16f42c33f9ef67076d631925b73721e56baed5037c0dc411074 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in cordelia-node-sass-titan-janus (npm)

Source: amazon-inspector 0aba470b153d913a8363811c0bdbc4300aa4833b9a41af28b0d7a3c678ac301e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in compile-validate-sandbox-node-async (npm)

Source: amazon-inspector cdc4473c74d323ab1478cebfa6f67c5738a3dc065c1c5261534dc58cc730cb86 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in common-node-libraries (npm)

The package common-node-libraries was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in commodity-node (npm)

The package commodity-node was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in commitlint-config-angular-firebase-node-config-wezen (npm)

Source: amazon-inspector f4f2862c90083d0e858dbc19eddcb13d4246beb63decd5dd5511dc3e4d9f3fcc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in command-blazar-node-config-phylogenetics (npm)

Source: amazon-inspector df133bbe3175b2b97814f29bb869e45de21dc1dea9644a52e44a5a7ca1c80f1a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in cli-node-config-eridanus-dione (npm)

Source: amazon-inspector c7c9e5f61f95bfcf4d2b38af3999e0c0645e84cb36f4d520d8df699b673e6970 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in child-process-stratigraphy-subduction-node-sass (npm)

Source: amazon-inspector 2e7c49dd3945225b658c5a51f33c18f72ccbb43fd246685797fce72947468f0a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in child-process-concurrently-chakra-ui-node-sass (npm)

Source: amazon-inspector 66acf8a52ab5f47e31e87daa88e9ccc679f3580c46543cd05ee50741b3f97448 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...