Malicious code in bambang-nasiuduk23-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c185cdd276a1e9fe3f84c4e519f8cb3c500e096843083a776f5d56672014e098 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rina-lodeh54-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb9b7746e295212fd56bf116915b8a39aebb8f82d2af8dac7a492760a27837ac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-123457 Malicious code in surya-lumpur80-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f90a7a94a0abb52aed02d02dd8eff4f71bffcf5d94ae885bc224118c3a0602a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in corporate_vole_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a52a7a7f83a1213b20ed38738b9fc28c01974fb4c9d0f8f6ff3ce48121ac08c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-112641 Malicious code in alternative_squid_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 599ec935bd662dd20e395ecdf4689ad5a61e4d4080a800f0b9a425ef3e598238 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-112183 Malicious code in persistent_moth_blush-42 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36ed174a62c9818b0d243d4632996727f416ab563765945b4bed89f0ea9df32e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-110905 Malicious code in wide_mollusk_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63be89c0337e8590fd689695161145916d18c9cfb1a51219cb62de6056479bff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-96290 Malicious code in remarkable_starfish_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e8c2c19aa996d87d2a33b0af75fda3ac7cf2ab70ac132ef60c3f38894882983 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in familiar_firefly_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dde47e4da4a3c9688ef9561c5a478082005afb124d70c6e5cb20d374b443c00 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-80581 Malicious code in patria-getuk88-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f57ccc5b901d3754e050063a8c66040b3894ccb57f8af914589e837389149a1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-75401 Malicious code in sari-nasisayur32-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 665d01354f9146a565cbd07248c9024234866674b7053d622c30204395f66cf4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-66287 Malicious code in yanti-lupis62-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f48f5bc630fd03fb157b413fff4793fe7c88063972dae6ca4aaa717aa89caa3d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in successive_weasel_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61bcd721fd295c6bb67a3d7e0c22b7d2694e3e4f4a64474c6b1a45bc307dfc2c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-54520 Malicious code in qori-sambel42-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f479aae0072b93acc36f085fab906b40a1ca4bd5fddfd104f0e90dd00f4a8731 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jaja-keripik62-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4dd5cd9ae25b80fe7270907d51f42babf1aa6a2be8621ad8368d290eca8cddb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-51240 Malicious code in candra-sasag4-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 640cf7b6dc72d186b23d59820716be614302f7dd4d1a2942c9113f96fe234638 The package candra-sasag4-miaww was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that floode...

EUVD-2025-38343

The Simple Downloads List plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpajaxneofixsdledit' AJAX endpoint along with many others in all versions up to, and including, 1.4.3. This makes it possible for authenticated attackers, wi...

CVE-2025-63639

The chat feature in the application Sourcecodester FAQ Bot with AI Assistant v1.0 is vulnerable to Cross-Site Scripting XSS due to improper handling of user-supplied input. An attacker can inject malicious HTML or JavaScript into chat messages, which executes in the browser of any user viewing th...

CVE-2025-12415

The MapMap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect nonce validation on the adminshortcodesubmit, adminconfigurationsubmit, and adminshortcodedelete functions. This makes it possible for...

CVE-2025-12402

The LinkedIn Resume plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.00. This is due to missing or incorrect nonce validation on the linkedinresumeprintAdminPage function. This makes it possible for unauthenticated attackers to update settin...