EUVD-2025-179278

Malicious code in dog-water-double-sudo-export npm...

Malicious code in sun-throw-export-xml-java (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1a8c5c8cb4363555683f11715c0cc35f6b75890f98cdcb908f646ad221baa6f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-175693

Malicious code in void-uglify-warn-export-zero npm...

EUVD-2025-179742

Malicious code in chi-short-export-assert-execute npm...

EUVD-2025-178962

Malicious code in export-bad-compress-fork-compress npm...

EUVD-2025-175816

Malicious code in unix-web-export-key-data npm...

EUVD-2025-178958

Malicious code in export-resolve-theta-slow-refactor npm...

MAL-2025-189336 Malicious code in sandbox-export-integer-alpha-java (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d6426877b9703b2cc29ae7e3069049eb2d4cfe9a922f49dea5024fe34d259c3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185433 Malicious code in alpha-integer-pi-assert-export (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a34951bfb26b2bf73403b5a41d1b38d6088c5a6558b84230cd7bb1e901125fa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-178961

Malicious code in export-decompress-integer-encrypt-void npm...

EUVD-2025-177790

Malicious code in mock-parse-earth-export-hot npm...

MAL-2025-189656 Malicious code in star-route-query-export-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c20beac557c34a749310f87e0f1b74f8044729c51c474177886ce1fc005f2d3b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in route-proxy-alpha-export-monitor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82ed7ce7a196ba7ed5bc586cfdd287f1bcf2abf295da782560005753652fe5b2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-176305

Malicious code in socket-minify-export-catch-file npm...

EUVD-2025-176138

Malicious code in sun-throw-export-xml-java npm...

MAL-2025-190183 Malicious code in void-uglify-warn-export-zero (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a289220d5fd74e336a5702c92af3412df6ca9b1feea3e4847d79f92987df0c7e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189929 Malicious code in throw-simple-old-export-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7fa0e7015572a5c0c2140d2bd0a0d6d2e85a91da0626aa234799986419d1f56 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-46782

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce plugin for WordPress versions prior to 2.11.25 Description The Welcart e-Commerce plugin for WordPress has a flaw that allows unauthorized access to data. This is due to a missing capability check on the usces export action...

CVE-2025-52186

The Lichess lila chess server is vulnerable to a Server-Side Request Forgery (SSRF) in the game export API before commit 11b4c0fb00f0ffd823246f839627005459c8f05c (2025-06-02). The root cause is the unvalidated direct passing of the players parameter to an internal HTTP client. This allows remote ...

CVE-2025-52186

Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c 2025-06-02 contains a Server-Side Request Forgery SSRF vulnerability in the game export API. The players parameter is passed directly to an internal HTTP client without validation, allowing remote attackers to force the server to...