Malicious code in parwo-poke16 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3149813cd96c29ff7c811c175bd9034e12068a33ee8ede1d4b8526679b5d817f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in uinsnu-lotaizmi-kulsimu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72f283baae6889a0013abe15550be486fee6dac12ce2d6fbb1a8931af6065e3c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in miracle-dibook-ikaliku1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bb90ba99390cb39a1c7747978e1c6db3a3542aa1950f2af4965cf7afa526ac7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-153871 Malicious code in bitha-71 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ee994ec6d82ebc1ad956930eda682668a42c7db0afc4a94b1eab7abe94ecf82 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-168943 Malicious code in tehah-badutsafi-rkonatol (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0cb4867bc3c06c06d6b4393cb0b5c9f406a7b68c23e2bd92767e1d13083acaa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155083 Malicious code in fini-savion-trans (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c522b75886a74d5060eb03a1e5fb01f1762eae2bf0ae905bca07adf2ccec8ee0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in inal-poke106 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a592e7a7df85659bbe14f6cb8d22e3b130ecdab71bb323bb792b442782c8bb99 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-163265 Malicious code in nokire-nanali14 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a6c6ebd5988ab6ef44dfea92039647660beeee9d029d095c84a51a4e5b0bb61 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-157831 Malicious code in kuinsu-ukiu-vilkuaubimi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2104f6c5b55f913f4d505b3737f510369073c21b16a92ffdc45b58aa125c9bbc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-151122 Malicious code in abeh-poke25 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c879be3a43c608e1bda997c9255ea5cd18ab018edebe1867e61f407d568dd4d4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in toml-jovian-non-blocking-weywot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51f63cdbda71e6348e3fa77a13ab444871e387aa663565f05d8a08312ad11fd1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cluster-ignite-ganymede-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14437d0aefae1e385cdcb8120bc09283f513bed896c77b0dbe800c278ed0f2d9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fond-copper-platypus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 679bc3f0be0d096c7197b95397a01d24f75767f4a40dd4f33a5d2d564a929856 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prepared-beige-prawn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44a7795dec554714ee6d12138c4b61dc1eedb909e572d48fa3de60066f609362 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Rarlab WinRAR 安全漏洞

Rarlab WinRAR is a file compression/decompression software from Rarlab. A security vulnerability exists in Rarlab WinRAR version 7.11, which originates from cross-site scripting in the Generate Report function and could lead to the disclosure of user information...

PT-2025-46677

Name of the Vulnerable Software and Affected Versions WinRAR version 7.11 Description A cross-site scripting XSS issue exists in the generate report functionality. This allows attackers to potentially disclose user information, including the computer username, generated report directory, and IP...

CVE-2025-52331

Summary: CVE-2025-52331 affects WinRAR 7.11. An XSS flaw exists in the generate report function where archived file names are embedded into the HTML report without validation, enabling injection of HTML tags. This can disclose user information (computer username, generated report directory, IP ad...

CVE-2025-52331

Cross-site scripting XSS vulnerability in the generate report functionality in Rarlab WinRAR 7.11, allows attackers to disclose user information such as the computer username, generated report directory, and IP address. The generate report command includes archived file names without validation i...

Malicious code in putri-bika14-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9004aaccee21934fee12362c3ba8e9a0c6b86c153ae6f5197a971f480d74142d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138515 Malicious code in zesty_armadillo_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba71d65c17f09bd483755a349822375ab78248de3b4c9e9b81262ea343dd4798 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...