Malicious code in sabuoaopa-muyafig-budfaiufa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc64ab1950d93a41ac83cb8dc8b650019b05ff82484984bd9a702163c9888c0c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-150001 Malicious code in @mipta1/edgr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a4bd34d783880affb80a7fbb13902e490b0fb80c2635f558b8cefd73402150b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-159689 Malicious code in mans-manapa-nuyadya (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dbce09e93d02d8bf0b24aaba3cb8bfa211941d344641a154e254a251855f972 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-168091 Malicious code in tealove-aruma35 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8782464b1e3666d619488b3b3d552e889bba4d0147b5e7494668ea92ce5f896 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155721 Malicious code in hariyono-poke116 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bed5e2704922f4775f8619b06535a8342c0589bc98f8d8463adffba95e3ff98a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-158150 Malicious code in lina-poke64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1abf74803326fedb4c1484554d9cbe73e4ad01525bad4ed3abfb00270b1516c1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-154634 Malicious code in dian-poke96 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4869f77021b5c388b122e7a2e206612f9395111c353f8a35b6428aa304ff1b28 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-154304 Malicious code in dia-22 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fa771970333a616dcc0a3b6d59a32b3eb2c070ab6d414ea7c734417c4b48ce1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in keyla-poke52 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7f3f791359f4cfae22d7aa0a844b686dbf1ab802111ebec15be6d18fd4bb7a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aibona-moilpe-aromo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daa0ea142057838f21d19e75bbb1feced143fb20ca6f7c5dd308c68c2fb87fc9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rinto-poke74 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 998e649d24ef0b6433ef50b1e03e9abe188d3dfc85891911b00009c6ca25b664 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tealoveness46 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e584af4f3207dbc58d56132e8e1850937c785f048a234a94dc8e7f48253594dd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lookingan-nalako56 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4d49db5e9e163b3cbadbfb78dda4a2807b727967d95e06fb8c7670acefe9a96 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nabuf-otgaf-doifo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ed1bd871287fcb650cbeb0e06997542f7b8fb20b30c13f666ac4d869a61ddb3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nokire-rara3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b487bd94eec53c23572dae0000f0be3d8f8d4814f2879c7f58353eedbdc07ebf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-150671 Malicious code in @miptaa02/fshg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33ef14016babb38ae9b908bd128172debee2a2607cc864e2f0c58e2ce55019b7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teagood-yakuza91 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9e031622907c3de861443b0e460ee05e2cf9d219a384df18ff55f5a101abfec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-119994

The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/bookit/v1/commerce/stripe/return' REST API Endpoint in all versions up to, and including, 2.5.0. This makes it possible fo...

CVE-2025-12633

The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/bookit/v1/commerce/stripe/return' REST API Endpoint in all versions up to, and including, 2.5.0. This makes it possible fo...

Malicious code in scripts-oberon-draco-pavo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed3525dda84b2464924e546f9db3f3b484347614d1b7b1e1a561b063779b2898 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...