Malicious code in scripts-oberon-draco-pavo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed3525dda84b2464924e546f9db3f3b484347614d1b7b1e1a561b063779b2898 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141005 Malicious code in concurrently-firebase-remark-postcss-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc2bd0fdd87661ce67e74c146f4b7b9cc662fd907f84c6906e86d075e198c677 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in capella-axios-build-ophiuchus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6de1782855692574879b52f874525f81e799648d8226dcd053e2552dc17fcfb6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in umbriel-chai-celeste-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb53ad9f8260d9f1a374259b5f212dbf32617f7afc84f7ce85b009b16a3e5db2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-11894

The Shelf Planner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several REST API endpoints in all versions up to, and including, 2.8.1. This makes it possible for unauthenticated attackers to modify several of the plugin's settings li...

Malicious code in rear-plum-parakeet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ffd81f1734d7fa552bd5594dc59d95992e061a66053a76bc90bccdf93c4904d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in alright-jade-armadillo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7469f2a081d9b88657ecc464dd738f41968414e838c4721031fd172da2e3154 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

WordPress plugin Booking Calendar | Appointment Booking | Bookit 安全漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

WordPress Simple Downloads List plugin unauthorized data modification vulnerability

WordPress Simple Downloads List plugin is a plugin for managing file downloads that allows users to create and manage file download lists on their website. An unauthorized data modification vulnerability exists in the WordPress Simple Downloads List plugin, which can be exploited by attackers to...

WordPress Contact Form 7 AWeber Extension plugin unauthorized data modification vulnerability

WordPress Contact Form 7 AWeber Extension plugin is an extension plugin designed for WordPress Contact Form 7 plugin for automatic synchronization of form data to AWeber email marketing platform. The WordPress Contact Form 7 AWeber Extension plugin suffers from an unauthorized data modification...

PT-2025-46570

Name of the Vulnerable Software and Affected Versions Booking Calendar | Appointment Booking | Bookit plugin for WordPress versions up to and including 2.5.0 Description The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is susceptible to unauthorized data modification. This...

Malicious code in eko-taiwan13-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd83e14368a7ae038b746a32cf390824e3d60bd38714b1e6cc4503363c9d6332 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138435 Malicious code in zain-pisang86-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb2a8ad7ee5abefd4096053629670d5cc438047c7b86328dd10df2d0c4eeead4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-64519

TorrentPier is an open source BitTorrent Public/Private tracker engine, written in php. In versions up to and including 2.8.8, an authenticated SQL injection vulnerability exists in the moderator control panel modcp.php. Users with moderator permissions can exploit this vulnerability by supplying...

MAL-2025-128793 Malicious code in nadia-sasag21-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbda6b40eb6fae5cd0023b51045172ab772e4ab5e950f8ec74df4494ac2f28d2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gilang-teh82-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0920751f702a87b02fdb1db456a585829246b4dd8d5628594e8391f2d4b1af39 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in civic_barnacle_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c2d860b4da0030bda4bbe3a315e93818c59b7ee0d9679722c2ebfa61090fd05 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wati-lepet11-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d446420959f7e3852f1e0596087296a4331ec5bde06c613d2f349781afde6f8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tiara-mieayam62-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 174398574b81cd8481cca4e1aed9fd51f6fa861893322333e36c2a97705a8de6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-119968 Malicious code in fajar-ruwet12-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32167dee81a16b798e9886c996952f43a49e3462ecf701e188a5a65f37e812c6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...