MAL-2025-78357 Malicious code in galih-rojak7-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e3b550e693b78328f46f260c3f3104e6d999f7556307d8247e1238f8dcd4ff5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-77380 Malicious code in combined_duck_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ca7eb694267f5569b4623fd252d18e78d06d73a928764a3021a8738655f3bac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-80413 Malicious code in ogi-dodol24-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77eef157a9f5f99714b57ff124921e840e1c02709352fd26a7be2505382c0e53 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12637

CVE-2025-12637 affects the Elastic Theme Editor plugin for WordPress, with versions up to 0.0.3. The vulnerability stems from a dynamic code generation flow in process_theme that enables an authenticated user with Subscriber+ privileges to upload arbitrary files to the server. This could potentia...

CVE-2025-12637 Elastic Theme Editor <= 0.0.3 - Authenticated (Subscriber+) Arbitrary File Upload

The Elastic Theme Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a dynamic code generation feature in the processtheme function in all versions up to, and including, 0.0.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2025-12637 Elastic Theme Editor <= 0.0.3 - Authenticated (Subscriber+) Arbitrary File Upload

The Elastic Theme Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a dynamic code generation feature in the processtheme function in all versions up to, and including, 0.0.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

Malicious code in qori-liwet72-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5777cd2954e8ff285e5d11e2b08d30fd5da179471b3dcd9fcc9ef6da228f0d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cici-lepet87-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2e8743000628f0e76d01be58099a1cb8256e29eac68d7782351b728b90c52e3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zul-rangi13-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5f36147e84865a431ee7c796d8440e557072b9f7905c876b63dc9b391385690 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lutfi-ruwet68-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 764077c42b5a071c711e9e500045d3efacad248540949a8d8f450940d04ae3c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lisa-gudeg59-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a9802d401ea885a1d60d2f608b6a53c6a0674edb4009f435853649f7b3b5bf0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zain-nasiuduk55-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c012ea9b55cc303a4789b5718d5399c6d6faee15476b3fb9f821f91700b251f7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in siska-bakso74-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddfd83e24b7df33544e56c11587a31a159df786163097bbe5195e515a98bd8be This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in qori-semur97-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac32ed44b09d127f46dcfcce72c1a0bafe1809e963dfc3d9a81809470d2b4144 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in putri-miebogor3-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a89cb6f4f3a2c06a0a44ba9a03ea8bccd3c0c19e75e38004c5e9ba42a67c0b1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kiki-moci32-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ba5c5394451004ca3f3dd3f32b887b9685a902d4513c1f336ad2daea5e8c22d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wibowo-bubursumsum1-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af05efb87921fde013e85b08e9efed97b332058af37a23b945cd1c5a3e5cb021 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ade-empal38-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d746ddfdba3833b8266af625de3b7a003cd7009295d30c1a38e5ebb870e7192f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in erick-brengkes75-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba236b4490badfb2ee6d1da615e036d8e5cbea0005bb22b73b9cf9886e8f77f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hadianto-serabi71-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa418ea00414e0b2b96111d1c918d1b31110473e207de1d5ac238989abcd8e5c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...