MAL-2025-81245 Malicious code in sari-ragi6-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19d3b3ee9aad58c7539c5ce6b5dcda876271d2b3e34e2bf070d4856320ab31f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fundamental_aphid_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a93f661f2842d29b84ebf54744002d22a57577ea350cc8c25207e91f998b0a00 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ade-kepok83-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5817c879c87f9060c03f0457b96c7d3239ce5d5ec288232834f3a5e16ca3ccb1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in selective_rhinoceros_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9e9a464bceced4db35f1a010c75dad61f9a4983101e1a5a78715185f2d763b0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rough_galliform_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2c542187cad43326d83220d9ade60d2ce3745cc01679642cf4efa77a0de82aa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in riana-jengkol34-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b15afcaff4052a45dda2edce1e62b887a1cdb674972dbfb1123dfa9942476ea8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-11451 Auto Amazon Links – Amazon Associates Affiliate Plugin <= 5.4.3 - Unauthenticated Arbitrary File Read

The Auto Amazon Links – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to arbitrary files reads in all versions up to, and including, 5.4.3 via the '/wp-json/wp/v2/aalajaxunitloading' RST API endpoint. This makes it possible for unauthenticated attackers to read the content...

CVE-2025-11451 Auto Amazon Links – Amazon Associates Affiliate Plugin <= 5.4.3 - Unauthenticated Arbitrary File Read

The Auto Amazon Links – Amazon Associates Affiliate Plugin plugin for WordPress is vulnerable to arbitrary files reads in all versions up to, and including, 5.4.3 via the '/wp-json/wp/v2/aalajaxunitloading' RST API endpoint. This makes it possible for unauthenticated attackers to read the content...

CVE-2025-11451

CVE-2025-11451 affects the WordPress plugin Auto Amazon Links – Amazon Associates Affiliate Plugin and allows unauthenticated arbitrary file reads via the WP REST endpoint /wp-json/wp/v2/aal_ajax_unit_loading in versions up to 5.4.3. The exposure can reveal sensitive server contents. Public discl...

Malicious code in sinta-kue60-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ac2cc8a18e8b9942b18778b5933defdadc40cfd15ce2197f9eee4b2e6ff9583 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-75491 Malicious code in siska-lupis88-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b55d8266a36037007e15e99cdfe626abd48a630218ad4c3fd23320690541f7dc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ida-telur63-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b183987bdb426a41bbf493598aade9b0f930be357791049c1991ee1ee84e7334 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-74904 Malicious code in patria-pisang76-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5dbbe7921909c12c8eeddf20ce40841591b371fe04cf7f211502251997c10fc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-76326 Malicious code in xaver-serabi18-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2df0aad1ce83a72a5c2b7098cce2384de23fc97eadd405149f93849765c1aeda This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kurnia-kemplang21-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f69f7a1ff41b14f9940e73ac3968fd65833a3c3c950249b6d3bc33d28808106 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

WordPress Auto Amazon Links – Amazon Associates Affiliate Plugin plugin <= 5.4.3 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Rafshanzani Suhada in WordPress Plugin Auto Amazon Links versions = 5.4.3...

Malicious code in moderate-aqua-marlin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a1b7dac0949d437dcfe21ba18295b461e2565b2120518c51dc0b3b6767196e8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in modern-peach-quelea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 511c60a346d5b0bd892399ea8aab34dff5d543cadc59e1cd9f08d03bfd80cf8c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in useful-azure-pinniped (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85bfc30d5a463b7cccc464c99cf73c70eaaaa12c2e9f8a1e40441c81a80c8e6a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in possible-indigo-cheetah (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4e42f7bb2da584bb623dcfe3deb3d494474369a7511cc67c356e3647c5c6c27 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...