CVE-2025-5317

An improper access restriction to a folder in Bitdefender Endpoint Security Tools for Mac BEST before 7.20.52.200087 allows local users with administrative privileges to bypass the configured uninstall password protection. An unauthorized user with sudo privileges can manually remove the...

MAL-2025-111643 Malicious code in acute_blackbird_lime-28 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f07187e0562aa868a5b145b1925efde1a3de1156ed1f48ab40c014eb819aaaa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-101861 Malicious code in easy_carp-notthedev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb4bfe7f4a0395943ec95e05fb2ef6b49e39ec6464127fde6009ef33fadc632a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-106873 Malicious code in overwhelming_opossum-silentdev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9175e0cf10f5ee62178cd6e1956173cd1c9a2e1ee08e0d3838a0e891180fd199 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in quarrelsome_salmon_pink-97 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76101ec9020e064849bd6811f8ab88cd98420c4ab6695970f4be9ec60187dfd4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in notable_swordfish_coral-55 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5544001be2a29a5176310fcc37f348d8e1ba8fcea6637b1b02885795986fef95 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-106814 Malicious code in oswaldo-teadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b1d9207f7407ffc49738b413590bebb716d8b739588849ed71bfb64dec41465 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in joint_primate_0xrequest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4c86233f93da54de93da21ed21177c5f08f3ed58254190da41ba7f50c37b1ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-100149 Malicious code in budi-getas10-remi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d5b22439fefaac8448abe0dc8946923fe726b6341a44914790ef38064498e0b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-106316 Malicious code in nina-jamblang31-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f0938059ada4956c4e45f6230db27f5b8d788d83b4ae01f67801488d7d48092 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-104101 Malicious code in indah-donat64-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e44b4b0afc8e485dd477c15e999de21bbb912c40fc0fda08a9bbf7ffd12113f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-99545 Malicious code in arif-bakwan88-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88a3cc2f6e471405ef44597a230d7b74ba6f98102623aa8d303e331ec5ddefa0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-60939

The Ninja Countdown | Fastest Countdown Builder plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ninjacountdownadminajax' AJAX endpoint in all versions up to, and including, 1.5.0. This makes it possible for authenticated attackers, with...

EUVD-2025-60967

The Find Unused Images plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the fuideleteimage and fuideleteallimages functiosn in all versions up to, and including, 1.0.7. This makes it possible for unauthenticated attackers to delete all of a site...

MAL-2025-98584 Malicious code in zaki-teh14-tititugel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9ee1ebe94b87b04153f1d04a819a70013efede88c15b572bbb6c2cc7c416d7b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-95190 Malicious code in late_pike_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 539a7528ff5a7d6e08a94ef06f537e5680999ba6254ed73cf4babd58fe8a2919 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-95070 Malicious code in intelligent_sloth_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73e06d358ad0c0fce4817e35a3342e7cea27be23af6c3fde848b26b6f0b532f4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in visiting_quail_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5872cfc42df22f047a194c3807729cc064b3eeb3683e18718e9497c3f277ef3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-97529 Malicious code in zealous_junglefowl_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f25888007429c2306a5f3f6771724721b76297e1e1956266ec76a82a271a78e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in great_booby_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4f5e2790bc00373313044eea375dea243549a76e655715d6dd0e958b2725db5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...