Kirby is missing permission checks in the content changes API

TL;DR This vulnerability affects all Kirby sites where user permissions are configured to prevent specific roles from performing write actions, specifically by disabling the update permission with the intent to prevent modifications to site content. If developers haven't configured any user...

GHSA-4J78-4XRM-CR2F Kirby is missing permission checks in the content changes API

TL;DR This vulnerability affects all Kirby sites where user permissions are configured to prevent specific roles from performing write actions, specifically by disabling the update permission with the intent to prevent modifications to site content. If developers haven't configured any user...

Malicious code in reject-static-theta-info-try (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a84dc4b74234abfadc82978e01f9a68d8516ac07a94e6666e93a5703d7fd7682 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in user-benchmark-omega-benchmark-socket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 695b5fa53b0ff23c05d1405285ee407040eee45a0bfb4eb1018bc5bc7f8652b0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in leda-epigenetics-redshift-geochronology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e0cb3e92026bed89ba1a7df8206dfb41da5cf939d0d3e4c83234ec51d085d83 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in meteor-chalk-blueshift-gulp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3261ab78dad9de4315430701c10bbd595ac7f1148a275b466115baea23d4af22 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jabbah-areology-archaeometry-vega (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1450f46fd9e16986c07c3d8779c3e55418dc857de0953803ae76fac04be89af6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in octans-sedna-entanglement-xerxes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e8de26676b02acc15c835b2db1cbc166b1c3da77c3fe9955268f44283710cc6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in deimos-redshift-plutology-google (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80168c73b44e90a928ec018382d63c6a2d7f6cfb4ca8704de3974a762297e32a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in grus-prosthetics-stream-prettier-plugin-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8349dbfa155f2d339ef3fd2ea67bde24011b09acb828ba410014298d1394d52 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spectroscopy-dotenv-cassini-sedimentology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0877ae9987490da3e59673ad1d155843077b9fb9419c1942c74445d2543962a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in json-babel-regulus-void (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dddfbf5848f4ab527768d15fcbe5332b5abad764f67e59c571cbf84288ebf928 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in publish-prettier-stylelint-seismology-cors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43052a28656f175ae88ca3541de9f3932eec1054bee702e2ee6c71eec895aa73 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186841 Malicious code in eslint-plugin-commitlint-config-angular-terser-commitlint-config-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 844532ffb61dedf116bb671dd0cb7a8e6ee68b4d6e7b7a3137265a273e7fca38 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187140 Malicious code in gemini-ionosphere-superposition-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d9915da48474b9a7fc365caff832585a7c79e69a676a479e6add1449dbf3314 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186742 Malicious code in encrypt-bundle-test-deploy-scale (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcaefcbdd1ffb8c51e8f0e7b02fe563dd40e979c5d81f3dc6babebe9775f54bc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186195 Malicious code in code-report-cold-iota-root (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64bf5e8505918bd9d308b0badcac899a832317e13a323ffe00e5666a0329a5aa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187800 Malicious code in link-upsilon-link-kappa-compress (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3067d1508451f6789510b62511e905e3046d9763f2244761c52bc46576b6b073 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185481 Malicious code in antimatter-celeste-meissa-cryptography (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d037036ebf23d884cfa774f83f05be5e6f54db51f57b71abb7497b085259edab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-190198 Malicious code in vuetify-greatfilter-terser-dysonswarm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5584b28a5c8bf2d3e596254b7bc342240b88e3d2b09ddf72fbce2ee6d922d906 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...