PT-2026-43158

A vulnerability was detected in Totolink CA750-PoE 6.2c.510. The affected element is the function setUnloadUserData of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. The manipulation of the argument plugin version results in os command injection. The attack may be launched...

Malicious code in eslint-plugin-semantic-release-chalk-fusion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7f76b381638ad18356b8c8d18b10785d541bf3b50f7d3ed0032bd37f205212b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in exoplanet-genomics-thermosphere-phoebe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c3eb6aa62f0ef2efdeb2e5a6edc6dd0fc792ad8dd18cec6011451d9b9b53b6a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fermion-solis-wezen-browserify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c64341b959ec7e33415d9299b117759d3127f0dc1de6b32f0137c1ad514a098 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in filament-axios-node-config-jasmine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01b4ca708c825886f59edaa9b7603233077a52e4be38ca0410b533b306826913 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in index-chi-grep-nu-wind (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 946e14211b226c9fbfa8034384b11c7e0a59c7788f474de387a9830d62d259bb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kronos-buffer-titan-zephyr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 792938793257953f6b2ebb196fc67715e7747e88d7f1d9dd52ccf05b0acb5b6a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lambda-transpile-gamma-omicron-resolve (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f99f0348d7e173dc7912d39e05ba519748d07e0d15a2ed0eb9e7b1a0fef1428 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in magnetar-geochemistry-remark-repository (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4df78ab37688f2bb7ad5ae145aa4a41be2f60db4bc5c2dc265ba44ce7565923b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in paleomagnetism-process-rigel-ariel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 806c222b404c6835419bb2dc3e3292a0bfea544dc0e55b7579ef348d91329803 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in scale-compress-minify-wind-interface (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74cf00479e7cd2290e4a0ccc2c84047c9a059d424a668bd7c886f48e901c9c1c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in scripts-duplex-innercore-mongoose (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 795b605e61cc15d48e6db76692728e9b0cf00f022d125f102ddb7cde83246cb5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in socket-mock-java-rho-spy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c73783490d318eb38b0f589f800124ffffafbe09192fd2fb01fc5ce1f82b4195 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in void-exoplanet-ganymede-geodynamo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c9a2c790225f2e208964e0a25bd71c0f64b5307be9ad53a6361c7098f046d5e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185893 Malicious code in bootstrap-solis-bulma-zooarchaeology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd3c4b90b728e10c24b350f3bbaa8da21ea46f25f548e1c3a7dbb67672704c24 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187948 Malicious code in materialize-stop-quasar-outercore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40c02f2b49861ae44e49dc7dbfbcee45f3efecf0ac13cc6817c5a72d030129eb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rain-theta-thread-star-simulate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3986a9a02494b35678a795f640466720c5fe1b0abe17f68d5b83e94604660e84 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185424 Malicious code in aldebaran-thuban-gacrux-apex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89edf3df3532bb49c2c76748f619d106892eaa539e1416145739aa8a307a1f0e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189569 Malicious code in socket-link-resolve-try-encrypt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d67a55af083d921f7f9ac00c877bed240fa3eaa206ab2eba52367102c6bcf86 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188606 Malicious code in pegasus-scripts-antd-antares (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 148f133e1fcaf9e6b0f51a92e0b77ef41f1bdf6ed12f5efd4ca90fe15c72a9b7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...