MAL-2025-186804 Malicious code in eridanus-buffer-colors-passport (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ad0a6bb846c89ee43a940cc41820b10715f3ed75eab1b0d1947860b70767ccd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189278 Malicious code in root-cluster-bad-final-rho (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e40f7f5e09039c8649780bc1df2004bbac256e735a86bd382908a03f1354e3a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-46912

Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.13.0 Description Directus is a real-time API and App dashboard for managing SQL database content. A stored cross-site scripting XSS issue exists that allows users with upload files and edit item permissions to...

PT-2025-46785

The Comment Edit Core – Simple Comment Editing plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.0 via the 'ajax get comment' function. This makes it possible for unauthenticated attackers to extract sensitive data including user IDs, I...

WordPress plugin Comment Edit Core – Simple Comment Editing 信息泄露漏洞

WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. WordPress plugin Comment Edit Core - Simple Comment Editing has an information disclosure...

WordPress Comment Edit Core – Simple Comment Editing plugin <= 3.1.0 - Unauthenticated Sensitive Information Exposure vulnerability

Unauthenticated Sensitive Information Exposure vulnerability discovered by Powpy in WordPress Plugin Comment Edit Core – Simple Comment Editing versions = 3.1.0...

Malicious code in mahnu-oy-giossisi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8da78aea58ec22d8ef0e2a79c63c6b333f98c79c5588c3d378f8ea4dcaaa0a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in manu-oyib-gisnoi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 605226e63b084c43a784bfc3c969698003dc3d29afa04502a921b876b9e5f06e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in masolv-ailo-civbu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de205376b72ca87d44fc471dfeba335ad393e1051c8d78afed1ee36b117b6114 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in masv-ilmo-civ (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6df44cee5b960d16ac94a8944b81b2c78b09b98abc3197087b4d16f1c189373b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in imodiov-omfi-cafacevaa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba2d72e4c0dab175c13203c5edf523dbc8c2dbb9ffc7a805cafc4163a69a17e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in avangi-oliutka-tabar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86ec69a80dfb84c03c5a4b2d9a9f81d697315a8ff78bf65062dec25b79bdca53 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in avangi-olia-iaiai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47093a7d8448c760ea60c35f842c7e45f15ea4b3b9d0f0e4292175c4c700ea29 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in flights-tuig-alumabiza (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb5dc7072783301417022129a030e14ed1bc9940b43ff35c110aace712dcc986 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in avangi-holai-inulmi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00789d98302d2d8003387a1c40cc86abe489a77fbfb7cade5372515c42f7d8fa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lomi-fis-fakugiukatajb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c14bd06c4c4e4c61766e632aaf5651d08dc0ae0427f99d3ad1179c28245566aa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in indea-fodij-agafaba (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb446a20f0c17cf06cd01f4ef86fd758b638806e168985fe5948675190195016 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in masolv-avlo-cobsabaasvov (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 374301fe9eee0ac01cb13d2900a67ec66305db3eedebf7dc6b7d3940bb3d8d2a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in indea-fodioj-agaafba (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ffa415c0e94f44db41fb74a51cd7d2414bbc6a4ec9868b2d2bd1ed899aac6fe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in itale-adci-ggpantekkkktololghyhbu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 744682a32a06e19441414050cf63c3caca95cebd14f85c3c1a96481a8cec0964 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...