Malicious code in sau-naki-upsidalue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1f724686b1d74bdf614030eafb6921169e837676506a6c28d377a1d2d6cd24e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teagood-yakuna100 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47504eb77d20f576e916ef5388e0a2c25b8e18573e92341d1ced8d3d321b4af7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in manda-31 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9ae87e183c43a35ba9ebd01ab5c4cfd66bb5933b491c27bb6a3d5db7fe84bdc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12903

The CVE-2025-12903 concerns the WordPress plugin Payment Plugins Braintree For WooCommerce. It affects all versions up to 3.2.78 and arises from a missing capability check on the REST endpoint wc-braintree/v1/3ds/vaulted_nonce, registered with permission_callback set to __return_true. This allows...

Malicious code in gulp-nightmare-postcss-cordelia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 100e04c09f791909f37fc08b18b6c1c118ce6c84eb94a477f339f2bd455a5caf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in commitlint-config-angular-firebase-node-config-wezen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4f2862c90083d0e858dbc19eddcb13d4246beb63decd5dd5511dc3e4d9f3fcc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in react-bootstrap-betelgeuse-rehype-betelgeuse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a48502acfd313350e9d45d87806f205bf7af5f2f5fbf42dae81303c0359192b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in altair-husky-elektra-izar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 397657c1f4752fc427c5c228a55cf0cbc4e0269830af8d4e9335b2378ad9d4e1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in flare-halley-meissa-jupiter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11ee29dde83f4e0b8f16285588b90dd4c94bf82be8c4bcf1fd7b1f20cb507e9c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cli-charon-hyperion-flare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5ef2f2d089a90c3c3b1dde64cf335631b185d51d318006a25ec5fb1376e7a14 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in avior-sedna-adonis-hermes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92f6a18b05bbbfb0b1dc6c244b97d5ce8fb073ecd38758720a74adb3d57de635 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eris-command-rate-limiter-xanthus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7abe993bf638dbe98c04283aed6d10f5a2bb33bcdb8c09e606063d2c0a09e55 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sass-loader-husky-kaus-cz-conventional-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9f5507ab2a765098b7094518c0513e392911542fbd29ea2b6ac804164375eba This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in react-bootstrap-enceladus-oauth-antares (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3975364cd584979fb854f2c748200a3cfe076aa7bb4f0fa02f2739d144b73a20 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in achernar-magellan-server-auth0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2f2acec02551e19c519fb08429a857027f87ac2d9ae888c056fe99dc5cc9e05 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ini-passport-quito-mongoose (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe2ffeb311d8f1e110ffa3b60f8f0c6ac8e6d86e6a7314e921dface5e09c5170 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sagitta-oberon-json-sadr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25cb20254e1fba013cee3ebbdc026315453ab57faff4d5dd7e2f54f5ae271983 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vulcan-helios-carpo-local (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51fc2186a8b8d2cef5c43c813a9358578692c3659d29973ad9eafd99ac01cad6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cassini-optimize-css-assets-webpack-plugin-callback-ignite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a4d26d4873796782551905789c7fd81ed92473600d7d9e682e8a4f349c24e1e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in deneb-europa-halley-kaus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8de3316b78b1b3497cd85456c92a3f1faa8d33e4f1db4ae920316ec0965c5dc5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...