MAL-2025-111969 Malicious code in helpful_horse_scarlet-6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38d0f75ad45c0484e249c3fece91a6c797baabca501015d737c02060eda2c4ac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in electoral_lion-smiletea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27cbe37a12f73e4f849a72de1c96a5db5a0478a854abc88f8ada4cc6a6211076 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ida-ikan31-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb945f19e235168c5084f44b085d1c8b02c786c6ade7cffc9da04844ea288f0a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-95958 Malicious code in powerful_cheetah_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1735174d5b9f628d6803c267d196476bce24dfcbb84804bd72dd5ff9fd0dabd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-95915 Malicious code in pleasant_pike_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d275d9230160db8f8882a9901e0773dd737bf940f9f364cdc582d0befe08319 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-95571 Malicious code in mysterious_caterpillar_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f83c265101f8581a321eec996c4db5d2876606b88a0abda637aaa6f2b94bcea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in andi-tiwul30-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89446830b3bd2a920b9c64a5110c915595f8ac681a3f62e8baff1552b0e28e23 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-86783 Malicious code in irma-keripik35-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93b393fcd9924686e77ddff2586e4f579b8dca659131e01f217e3ae94411fca2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-87769 Malicious code in legal_jaguar_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bae3219d3210c1d009482f9eaea402272b083fc8e39daf09756f94a1ce351d86 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-11821

The Woocommerce – Products By Custom Tax plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wooproductscustomtax' shortcode in all versions up to, and including, 2.2. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes...

Malicious code in hadi-serabi47-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a410797049b4a102e761c3ec4f232fec54975dbed1b92e3289e2bb83ced53937 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-74576 Malicious code in nana-serimuka20-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28c5a3364326985632d4d41faa4f37466dfbe39dca330035cc0e944b9dca4fe9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-75539 Malicious code in surya-oblok60-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c4e96dfdfa09d951566fbe24b31885d56d8f9999bebae0ec12a6acd74eb488f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in grubby-silver-chinchilla (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 24d0574725fe4a8eb858a2497850d49ac98154fbf42fb40523e9454ed99fe3a2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gleaming-amaranth-deer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d5270c7996565141cca335512a3cf42f4182c9b0f21430c769330f15a65df15 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-65499 Malicious code in surya-tempe45-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e9fb46902c2971a081379d0b3fcc638ec3aef5c5691f71635db1063971ebf83 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in noble_caribou_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bd800c6baf4a4d0607b546f30a7b2ad6f8b6189f5354d14a87f3d9e0a488bc5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-57695 Malicious code in mulyono-toge81-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cf607b05f373bd0ebf725c3950311dfdf0acd1a02170ce1a629d04c194730c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in iwan-brengkes8-sumpek (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72562e05b1a0ab7da3612d611ce92b5c9b5ccfbcb6b6af655cc61e437042055a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ida-getuk91-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector adaeac6a945b618ec4d76c886e37e03a022112d2168667ce04c08f1f3f71bf61 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...