MAL-2025-154304 Malicious code in dia-22 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fa771970333a616dcc0a3b6d59a32b3eb2c070ab6d414ea7c734417c4b48ce1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nokire-zabuza51 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0afb8fbb65960b87e76d4578ff06d671acf9d2aea7a96ca0f283efcffa12e50f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teagood-yakuza91 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9e031622907c3de861443b0e460ee05e2cf9d219a384df18ff55f5a101abfec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in uinsnu-lotaihzmi-klsimu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 100e1398b238a51b2fa04ebd74e9259b5a36e8b2e57fc60fecb7428d498b2bd6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teagood-lokika16 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 645bdaa7ea3ebd63a423346c979d92ff2a56eb2eff30d9e78cae905caaa99e65 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-119994

The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/bookit/v1/commerce/stripe/return' REST API Endpoint in all versions up to, and including, 2.5.0. This makes it possible fo...

CVE-2025-12633

The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/bookit/v1/commerce/stripe/return' REST API Endpoint in all versions up to, and including, 2.5.0. This makes it possible fo...

Malicious code in scripts-oberon-draco-pavo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed3525dda84b2464924e546f9db3f3b484347614d1b7b1e1a561b063779b2898 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144174 Malicious code in kinetic-impulse-polaris-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dae9f06594bf0c0f9bf149fd6065ba7e289724e2ad9f2bc222b94bf5de59733d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in non-blocking-supervisor-ophiuchus-eclipse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f939fe54d02544db9be3e7c6ea222a84099693d0f32fdf8582144f656082507d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in await-altair-got-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a660fc5e738c8d00b5f3881d89852c995e28e12b38ece3a1ead965d679ec57a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in umbriel-chai-celeste-registry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb53ad9f8260d9f1a374259b5f212dbf32617f7afc84f7ce85b009b16a3e5db2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145004 Malicious code in mira-cache-cross-env-babel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 300f84b23994bc74cbce26b47d6fa618ed69bc1cd0ffc0ca0702cdd19eb02cec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in capella-axios-build-ophiuchus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6de1782855692574879b52f874525f81e799648d8226dcd053e2552dc17fcfb6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143904 Malicious code in jekyll-fetch-lyra-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 629b4fa570a0d70e8141464581ed15f4719b44b0916381a26d46e3b4a2b7a6c6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141005 Malicious code in concurrently-firebase-remark-postcss-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc2bd0fdd87661ce67e74c146f4b7b9cc662fd907f84c6906e86d075e198c677 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-11894

The Shelf Planner plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several REST API endpoints in all versions up to, and including, 2.8.1. This makes it possible for unauthenticated attackers to modify several of the plugin's settings li...

Malicious code in alright-jade-armadillo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7469f2a081d9b88657ecc464dd738f41968414e838c4721031fd172da2e3154 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rear-plum-parakeet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ffd81f1734d7fa552bd5594dc59d95992e061a66053a76bc90bccdf93c4904d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

WordPress Simple Downloads List plugin unauthorized data modification vulnerability

WordPress Simple Downloads List plugin is a plugin for managing file downloads that allows users to create and manage file download lists on their website. An unauthorized data modification vulnerability exists in the WordPress Simple Downloads List plugin, which can be exploited by attackers to...