MAL-2025-156855 Malicious code in iqbal-poke48 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8a77ceb9f596aa5c0d45d339c1226ec41b3ea59949b04a7e3895d08659d47c6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-156198 Malicious code in ilal-poke90 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6b485fcf742dad795c5579c242becc06c58173ecebe3ada950e2643f50c3f07 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155002 Malicious code in fatidra-faradda-nuydcuda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cc73d1da69d1efe4c5f23a163e94498b99b9c286473ae1f777d7ec08c208d2d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-158592 Malicious code in lookingan-namakiki78 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0ff5e98b0fbef45f503c05e537cc2e6ab2d7d7f6e75342d22d13100095f5202 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-164261 Malicious code in piluvaika-kaiu-nubuli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e70bf791f4d59beeec6fd476634496370654cf12b7dee7f984b7f3405ff7633 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-156220 Malicious code in ilang-20 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34f315f0f8a42662389148954718547626318a2ca0a76df6f528a0423fa19ef4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-156103 Malicious code in ilal-poke108 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3d8dd85fb416f696654327028a8507a6450aecc2057af071a4d2ebe4a5758f4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12903

The CVE-2025-12903 concerns the WordPress plugin Payment Plugins Braintree For WooCommerce. It affects all versions up to 3.2.78 and arises from a missing capability check on the REST endpoint wc-braintree/v1/3ds/vaulted_nonce, registered with permission_callback set to __return_true. This allows...

Malicious code in tailwindcss-slidev-antd-elara (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0be2c69fad5b110b2dbeeea015fbe299ab9aa61c3feaa29d68a296c5fbf22be This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vulcan-helios-carpo-local (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51fc2186a8b8d2cef5c43c813a9358578692c3659d29973ad9eafd99ac01cad6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cli-charon-hyperion-flare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5ef2f2d089a90c3c3b1dde64cf335631b185d51d318006a25ec5fb1376e7a14 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in commitlint-config-angular-firebase-node-config-wezen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4f2862c90083d0e858dbc19eddcb13d4246beb63decd5dd5511dc3e4d9f3fcc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jovian-izar-subscription-titan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8681257e1e1eff9e0b4be2eb9aaee7190c6c99222e20e0f2d9e0508d2fee6c20 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sagitta-oberon-json-sadr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25cb20254e1fba013cee3ebbdc026315453ab57faff4d5dd7e2f54f5ae271983 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rate-limiter-unuk-less-terser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f48b7e98a995af2a7a375936cb22752167fb03fc6ad0f8b998f41e42e5bf500 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in graphql-virgo-prettier-ursa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aaf0c2ff36e58cc35243ac8e68be82032aa3e1c00c0ac502474a893c01758736 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146633 Malicious code in promise-bellatrix-helios-acamar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e2bc2261e80b41b4ab426dc70dd2937838890d8d5ea543a3819a37e3e44e920 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gulp-nightmare-postcss-cordelia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 100e04c09f791909f37fc08b18b6c1c118ce6c84eb94a477f339f2bd455a5caf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sass-loader-husky-kaus-cz-conventional-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9f5507ab2a765098b7094518c0513e392911542fbd29ea2b6ac804164375eba This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in achernar-magellan-server-auth0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2f2acec02551e19c519fb08429a857027f87ac2d9ae888c056fe99dc5cc9e05 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...