164 matches found
Malicious code in zephyr-quito-barnard-mui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0999778b0d4a307745cd342194d1abc44234bd567279fc3aaf00c47c785312c8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in chilly_viper_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e51849bab86b079dfbf084e3031b651e040f0856fda4d441798cc7d7d3fc17c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-129071 Malicious code in official_possum_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98620a18208f2d69a16e980d6eb6bf63037aad604a840c1a1c5d862f1878fd60 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-130068 Malicious code in sari-wajit55-riris (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0f4b4caa3f597b86f198fd3b4e6d989d1cf796ad3d6e3da812934f971d6b6f5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in fitri-sambel40-miaww (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5deb27c6f13b88feeb60ef24eeb2009646273b34fa213fabfee40cfa7988c5d4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in organisational_kiwi-excellentdev (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9670c133109df77cd940a0270abcf16e706cd7e4897c37a929047fe0bf0e255e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in graceful_bobolink_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f86d0986c005f35c2ff44298e2e1573528ebd20472ff4c50d4bf11c210bf128 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-111575 Malicious code in zul-bakwan19-ruro (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cba77251d474fa7ce64180d1345a3f304e84f9fc701e53674971cc5196b219d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-110500 Malicious code in vida-rendang97-ruro (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8918f47f37b3b19d60d9d26627638b91fcf39e5c3d7445f72c181c1e916a9e4b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-86088 Malicious code in golden_earwig_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 315597e86c1e6dd16a21077932ee2eab49ec586c169aa2327a3689919ea406a6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in federal_asp_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aee5fa93ccbeb2374f35ee9f61a949e1c2d1e2850d4f4d3b3006a6b1e24133ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in yappy_tarantula_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2141908bdc5bab6babb1c688fd2b2ff212bda676e1615c8766f8a1674d1147d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-70642 Malicious code in single-tomato-lizard (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a403b53f912b2dacd56d45bc674a9c46f3862c982b05552eea1b7b06a5a34c9e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in lina-esdoger72-sluey (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0e438db75dfddeb8b79b67355ac9a68fc5d78242c14a6c62a740899868e3914 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-65424 Malicious code in square_halibut_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a580d127e0fe9c998243e3b3c929726c8e89164b2c4e371c0e74205b4337e25 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-65641 Malicious code in tomi-pecel42-sumpek (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 717d6c1663216e06a7641f4c6266e9dcd578a51049224bac36b52f6496530821 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in chronic_gorilla_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c85591133b03938159f23ce3f79d496e66e69baa984c7405405b299f816a7713 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
CVE-2025-11372
CVE-2025-11372 affects the LearnPress – WordPress LMS Plugin (WordPress) up to and including version 4.2.9.3. The root cause is missing capability checks on Admin Tools REST endpoints, with permission_callback set to __return_true, enabling unauthenticated attackers to perform destructive databas...
