MAL-2025-64932 Malicious code in putri-ragi18-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69e3773d109184289fddb333ecba7fa2ebcc8f03c98d2dca031372ba0b10fac6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in agus-oncom100-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54087abf29cb543aedf12bcd474af96cd0172dbefe88ea4445d9c50bb398abab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-65836 Malicious code in utomo-lupis43-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c996bc224867b669c3f1f5f35a594141ebfec500de63973e7a630da96aab34ba This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-61768 Malicious code in ade-saguer81-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef0ba1ee4dfecb08d4ea8a3f4639421609e4e2020b319461ca3ed780ab64d969 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-65717 Malicious code in udin-lumpur93-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8163aefc93f32c046d2e7836649aa5b834776ac020721b251aab8cf532982aa2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-63325 Malicious code in hanafi-tahutek57-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04196f1d88c91f0616f737286859c72ee9eb82d8ae25c86192242d645b79aa02 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-64993 Malicious code in qori-tempe15-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5390e545f0f95bb7f500cc66c8191259b5828377eab5f78ddc25aadf2b7cd938 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-62571 Malicious code in dirty_ermine_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f9432ba54b96faf86af72c23b73f2002d836893f48a0637bd1c6718214dc15b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-64276 Malicious code in maya-kue4-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18e105035efec0f84a16a3f8c9c52d0605c1f90b805769a881460c41185b53e8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-47773

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a dashboard is edited via an AJAX call. Versions 2.7.13 and 3.2.2 protect rendered HTML content...

CVE-2025-47286

Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, an administrator can, by editing the configuration of the iTop instance, execute code on the server. Versions 2.7.13 and 3.2.2 escape and check the config parameter before executing a command based on i...

CVE-2025-47773 Combodo iTop has XSS vulnerability in /pages/ajax.render.php

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a dashboard is edited via an AJAX call. Versions 2.7.13 and 3.2.2 protect rendered HTML content...

CVE-2025-47773 Combodo iTop has XSS vulnerability in /pages/ajax.render.php

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to cross-site scripting when a dashboard is edited via an AJAX call. Versions 2.7.13 and 3.2.2 protect rendered HTML content...

CVE-2025-47773

Combodo iTop is affected by a cross-site scripting (XSS) vulnerability in the dashboard editing functionality invoked via AJAX calls. The issue affects versions prior to 2.7.13 and prior to 3.2.2; versions 2.7.13 and 3.2.2 are reported to protect rendered HTML content. The root cause is an XSS fl...

Malicious code in rising_raccoon_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c91a48ca0d24b3bae10fec3b0b6bbb87961c03dadb0a07d9a7f356b4713a0da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in practical_bedbug_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00fc45f0d0d0b2ba9da3f61456a2a0d4bf98e338208e9771093772765fda01a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in western_manatee_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7a93d695f6a4dc7528c76da0df4aab5d983c48083df5c4a622785510a0af40f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fragile_gazelle_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d5835fd94e41b807651a6030a87a9fe4c7ebafb728c301a6931a5f908900f25 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in impressed_fish_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e936fd8be67bfe204b027c7e8c22d9b0cbc247d4d6d8eb6e3fc47e632390a68 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-60427 Malicious code in explicit_roadrunner_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 167e8e726e10403b2bbb404e4b89c1c0ab9175b5729edc4bb657edeb4eb7de4f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...