MAL-2025-68822 Malicious code in inadequate-bronze-kangaroo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53932b71f797bc22b1bde0044f33a0d4b5393fa5e6f2050c4655af034dad98e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-68753 Malicious code in husky-rose-gamefowl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a45eaaeb696a35d74b044628f2e629befbc5e4b56040e65b9255c7e0a5f921c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-69561 Malicious code in naval-amaranth-egret (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56daea3b4df95092392eece269653c7092d0a8fbbe3afc80673c1c51b2ff4d22 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-65651 Malicious code in tomi-telurtahu62-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f1cbaffddd5b7053a6232fa9d9c383027e6cfccc1a1c2e82033763ce15a3137 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-60543 Malicious code in genuine_leech_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 436838916fbad1d4044635416e997c8546bca747136f7aa228127fbda43d04ae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in riana-kue10-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70f710557d3e28ab37643e5837e68b638151cda3883ef9dd9cb1d2dc9e9a8693 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-58929 Malicious code in tiara-kue66-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dff865ed42651e8de3d4e42296091c689b3482b928a376fdc5cd837160ce616b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in surya-rujaksoto20-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e0d3853bf252c2a73b985a3ae6717bfe89814b011ecbadfb32646d454c5287c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-64147

Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

CVE-2025-64146

Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system...

Cleartext Transmission of Sensitive Information

Overview org.jenkins-ci.plugins:curseforge-publisher is a This plugin allows users to upload build artifacts to CurseForge as mod releases. Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information in the storage of API keys in unencrypted form within...

Jenkins Curseforge Publisher Plugin does not mask API Keys displayed on the job configuration form

Jenkins Curseforge Publisher Plugin 1.0 and earlier stores API Keys unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Additionally, the j...

EUVD-2025-36647

Jenkins Curseforge Publisher Plugin stores API Keys unencrypted in job config.xml files...

Cleartext Transmission of Sensitive Information

Overview org.jenkins-ci.plugins:curseforge-publisher is a This plugin allows users to upload build artifacts to CurseForge as mod releases. Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information in the storage of API keys in unencrypted form within...

Jenkins Curseforge Publisher Plugin stores API Keys unencrypted in job config.xml files

Jenkins Curseforge Publisher Plugin 1.0 and earlier stores API Keys unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Additionally, the j...

CVE-2025-64146

Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system...

CVE-2025-64147

Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

CVE-2025-64147

CVE-2025-64147 affects the Jenkins Curseforge Publisher Plugin (version 1.0). The vulnerability is that API Keys are displayed unmasked on the job configuration form and stored unencrypted in config files, enabling users with sufficient permissions to observe/capture credentials. Public documents...

CVE-2025-64147

Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them...

CVE-2025-64146

CVE-2025-64146 affects the Jenkins Curseforge Publisher Plugin (version 1.0) and older, where API keys are stored unencrypted in job config.xml on the Jenkins controller. This configuration data can be viewed by users with Item/Extended Read permission or by anyone with access to the Jenkins cont...