MAL-2025-149462 Malicious code in wezen-mira-morgan-indus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aced490826c2d7edbe824a07a4bbed1a8ee680171c14127269d06d326744906a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147619 Malicious code in sagitta-soap-jabbah-perseus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ce1eac91ce5b3dd1ba6b6ad4dc0e56d557a5b7264db95f7ee63c57767b13c5d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140542 Malicious code in centaurus-despina-pipe-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7412f390ed0a56288b73f2f3b4c82e88af73120b691359e975a6aca3e0cacf6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148139 Malicious code in spectron-webdriver-reveal-md-enif-jasmine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 370180c2f129f15a2de150851321c58aca4d76bfa479fa7d138492a2d75d83fe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147730 Malicious code in scripts-eridanus-duplex-spawn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cc40e9b3651a910d7a97424e0a6b2f9dfb784f58b1ac169adad47c54b88f1e8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12637

The Elastic Theme Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a dynamic code generation feature in the processtheme function in all versions up to, and including, 0.0.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

MAL-2025-139155 Malicious code in shaky_egret_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dd5cd6e4b9659fadbfceeaadabe8b3c137cd2fcd97adaff2f97d46e62e1459d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in linear-blush-boar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a32f6df09387d966b3d14c2deb992251c6e5e285791c8d546a0b6510a4462340 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bumpy-azure-hawk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c5f81245c095a0db2baf7931861ca5afe91e1f67699c5758ac97ac1111fa71f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138755 Malicious code in glorious-pink-hyena (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca66cba7a49e0510546cf9b5ea945ee6b4d7739adb038423cc8b23b1e01c981e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138643 Malicious code in curved-rose-limpet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 624feaf1b0af54e728dc8e3b6c3c82b6954734b2d8718b93d9bacc8f5e0471f4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139043 Malicious code in stiff-brown-tuna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee3ae85ff263a468b58321cab55d214982761da6ae5fe69c7f6f8139b4e61d32 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in systematic-chocolate-swift (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83d66d84fcfe28342c35ca4880f8e8c2c99807acdc60f3b9342d7ce0478641d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in overwhelming-lime-spider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9a0d2ce3084630b8aaaaa2ccee23d64366e300c6bde289088f5d116c6e2e395 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138935 Malicious code in pleased-chocolate-gamefowl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 874f1b9f8cd09a7220d567788a1aaf7dcc14772d94267485dc88dd46f55a08c2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138618 Malicious code in cold-azure-thrush (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34cd52b0166de72ca40e67be1e05b988770cd6030acc466099657a5a05dd5f05 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138846 Malicious code in loose-tan-bee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83426f6d8857b3e3e9fddffd79b800060ededb0ff10bd0a40fa8869a6a454aa5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in effective-rose-catshark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e118a10f0c55599ccf3867367e6398ed8a5180b40ecf9cc833d04ba1d4f7d592 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139095 Malicious code in varying-maroon-blackbird (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d532c4c516056ae0f4823fd186aa9df55ecff4f2fedd5d46ae96af890e43699e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

WordPress Angel Theme <= 3.2.3 is vulnerable to Cross Site Scripting (XSS)

Software Angel Type Theme Vulnerable versions = 3.2.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2025-10295 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 731931b06fd6 Credits WordFence Required privilege...