3640 matches found
Malicious code in bella-ongol-ongol94-riris (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b99c21ba24bc445a1ce068e0f5d49453ab4e1c23b09a276051c5c4e30a5bc7e1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in putra-teh12-kyuki (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f2627508cd3b9043f72a4684227b2b7ec7d32c2a85711d8cc6d921bf199c306 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-86035 Malicious code in gita-ronde94-wekto (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79b8426f902ca8938b6c249a0962acbc6fe692ac02567667d44303b08cb453a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in tiara-rujaksoto7-sukiwir (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 709ed1a76f94bd8ca41d25182062878e764a339895e2cceef055fc79a4b04f3a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-78163 Malicious code in fauzi-klipo68-sukiwir (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03edd6fa554df6238e8e7dd44f87e1feb5a756556d3dfb1bb9446920f3c6a29a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in dewanto-asinan29-breki (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f39643fb70dc89036437c501f02bd724799a1eb8ab013450ed9fa43f311b70a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-69561 Malicious code in naval-amaranth-egret (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56daea3b4df95092392eece269653c7092d0a8fbbe3afc80673c1c51b2ff4d22 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in perfect-scarlet-earthworm (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5ef5d538884a5142d698d907a16cf12aaead038846c4f4fc07b106c341cad89 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-68753 Malicious code in husky-rose-gamefowl (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a45eaaeb696a35d74b044628f2e629befbc5e4b56040e65b9255c7e0a5f921c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-68822 Malicious code in inadequate-bronze-kangaroo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53932b71f797bc22b1bde0044f33a0d4b5393fa5e6f2050c4655af034dad98e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-65651 Malicious code in tomi-telurtahu62-sluey (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f1cbaffddd5b7053a6232fa9d9c383027e6cfccc1a1c2e82033763ce15a3137 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-60543 Malicious code in genuine_leech_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 436838916fbad1d4044635416e997c8546bca747136f7aa228127fbda43d04ae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in riana-kue10-sukiwir (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70f710557d3e28ab37643e5837e68b638151cda3883ef9dd9cb1d2dc9e9a8693 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-58929 Malicious code in tiara-kue66-sukiwir (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dff865ed42651e8de3d4e42296091c689b3482b928a376fdc5cd837160ce616b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in surya-rujaksoto20-riris (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e0d3853bf252c2a73b985a3ae6717bfe89814b011ecbadfb32646d454c5287c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
CVE-2025-64147
Jenkins Curseforge Publisher Plugin 1.0 does not mask API Keys displayed on the job configuration form, increasing the potential for attackers to observe and capture them...
CVE-2025-64146
Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system...
Cleartext Transmission of Sensitive Information
Overview org.jenkins-ci.plugins:curseforge-publisher is a This plugin allows users to upload build artifacts to CurseForge as mod releases. Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information in the storage of API keys in unencrypted form within...
Jenkins Curseforge Publisher Plugin does not mask API Keys displayed on the job configuration form
Jenkins Curseforge Publisher Plugin 1.0 and earlier stores API Keys unencrypted in job config.xml files on the Jenkins controller as part of its configuration. These keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. Additionally, the j...
