Malicious code in hexo-duplex-xenos-bootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa1151ddade4025065c48113f1079d31279af60beb4be33b8708bba930be0e96 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189813 Malicious code in tardigrade-virgo-hologram-yaml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ed42039e0d9b78e3cd59ebd720e24df16a2da59377b7c2fa98dada31223e78c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-46851

Name of the Vulnerable Software and Affected Versions js-yaml versions prior to 4.1.1 Description js-yaml is a JavaScript YAML parser and dumper. A flaw exists where an attacker can alter the prototype of a parsed YAML document, leading to prototype pollution. This impacts users parsing untrusted...

MAL-2025-183286 Malicious code in kiudt-acavog-agaicua (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd2c32753b0e6c6e359ed6876d318de6f17f3448b22f3d8d8c44a1b98826a20e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gocay-guga-visagoigojhi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ba24826b7bdb486c617ba88e6f1ebdd88b9cfe97c3c7642be9b5254ae3c6c24 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-184672 Malicious code in oliobc-uyg-ugiafabafiuh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ecc8584bf3b41fcb355e5448692fafe6fa4210c6e37fd5778afe188b6c2c6f9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-64523 FileBrowser has Insecure Direct Object Reference (IDOR) in Share Deletion Function

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Versions prior to 2.45.1 have an Insecure Direct Object Reference IDOR vulnerability in the FileBrowser application's share deletion functionality. Th...

CVE-2025-64523 FileBrowser has Insecure Direct Object Reference (IDOR) in Share Deletion Function

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Versions prior to 2.45.1 have an Insecure Direct Object Reference IDOR vulnerability in the FileBrowser application's share deletion functionality. Th...

Malicious code in buis-manuis-boaad (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9baca5bc99b77b896ef5cd9725ee8c4cfb0cb3448455fcf6fbff7ee36022af0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tanur-sa-dafa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b871f0078a96c58ba1448967d257c97a2d2869066bbaee88ea0e2a333ee5f943 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rindaman-poke54 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6248cd617bead739d3da1ac6d2b8fe6b2746add565c6ab4b9cd7604ae97419f5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-172916 Malicious code in anidata-hadits-rispa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f168c55d6fafa727dd08f8bcc4b35b694aa48928af125a25634068dabb54de5c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-177475 Malicious code in poglymer-ognagah-agsashohai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cefcda8dca78fefc51cbca27e3d8df1eac83c9442d665f0d7bdb0e502f5435f5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-173456 Malicious code in buta-fippoa-inaofufua (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e3a3f71420bae11ffff2118a968e0925f09bf13cdb1b22fc408fa5cb2777630 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in guras-asia-nguy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0dec6dd05dac813c9e303f620294c4109d49f88ab393f921bb2eaa69bd913279 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lookingan-namakiki86 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb3c94fb08aac6b7c61397bbfca80d28e2d040d70f8f401be2559d57b51029e6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in verify-aiun-misuanuika (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d17bbf3893de1d4848a248bfa69a87fed300cc9606459f263bdefa40bc6b178a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-162890 Malicious code in nokire-loklok37 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1011dd807aebc9946e6370e01b5834272d67abd9a89507e143d1d004a4f2b1c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aben-poke40 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c3d93c4c695452d73e38e8881e871ca03ef7724a83884e398539bc648b77771 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-156529 Malicious code in intan-20 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abf73f43860555012c3c7bfbfabe7db726f4a4145291c446a5345071d8342aab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...