Malicious code in gravity-csrf-shelljs-celeste (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 341f7f2f7872be0850775e6d8315dcf63081cbcf5cc095b0af5b05bd2ef6ad8c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in virgo-backend-hermes-eslint-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05940c7f294c6b60ca9948a699c21c99f5ece74f5993de0fd374cd1fabcc5464 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148643 Malicious code in thuban-bunyan-sails-eclipse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f87d13068d3b1e7ebbe235715548e61fa520b765c466379b4d5c09348677bf3f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149246 Malicious code in vulcan-nconf-quark-child-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc3a3d0303ed5512de8dc5c006cf26b69d0a9a5dee11ec25b3c8433f45fd3631 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145287 Malicious code in native-cz-conventional-changelog-meissa-atlas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bac21f13b4b7614fa1c9af0606fd1809d609ba57b1a9f0340f11c23f245f30b9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147509 Malicious code in rollup-plugin-async-shelljs-procyon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd26dff81921adafb42e1a04235e7606401fabfd2575d8186a6e2b9b0acbbe14 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148369 Malicious code in subscription-xml-jasmine-apollo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8eabecc43d01c8587b8f2f53eb45388a9476cf274b7a7c45c565f45dddd21bef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in backend-configstore-node-sass-firebase (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef6b9ac0075b325abe952216f78ce9a11d4101d6d1aabdbee5e7aff20ac8216e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144328 Malicious code in less-loader-quantum-miranda-html-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f72622ee9f60adeb5f780beefca8e1efd2fb397f3f46dc1ae0ab8ef0a1b15de This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144828 Malicious code in meissa-prettier-plugin-markdown-celeste-vortex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8487cd6f918d907b2e090c92c6b040fb136aa96869c210a9ed51a5530e1c979b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143083 Malicious code in grus-backend-webdriver-mocha-transform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee762578e81ff651deb97f909d6088e265292074eacd07e99df87a2e09c9bed7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142552 Malicious code in fomalhaut-rest-xenos-vortex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b59d8633530988e6f0c2f5b25ba330adf84ea689d15e0e288004ed1d9bad46c2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145519 Malicious code in node-config-sequelize-nestjs-izar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21a3fa52b67b1625918b72e412baf8bc909bf559136d77e78c49538f4a634982 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148251 Malicious code in standard-callback-venus-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c54afa4fcb2836ea95ffb5db003dc4c6f9a022be7b0b74462aacc150cf13c0f3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142431 Malicious code in fetch-adonis-less-loader-figures (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f81723ebe229b7643b5a842d320415ccd1dd88b5a3c2d5e2b93c7a1944563002 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147451 Malicious code in rimraf-kaus-despina-grus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 440575175b8259dd2dc93390fc2ef519cbfec2dbfba191535b58896c6a7778e2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148340 Malicious code in style-loader-rollup-plugin-izar-phoebe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec4a0e6674e333da99262c9589dc038cd6e957c309248b12349a0364661a27f5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148039 Malicious code in soap-vega-hydra-jasmine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fe645bba34b0e4e8d58c3cecb6d63b49c6452156e804d022ec335a18e9eac1f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-11532

The Wisly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.0 due to missing validation on the 'wishlistid' user controlled key. This makes it possible for unauthenticated attackers to remove and add items to other user's wishlists...

MAL-2025-138731 Malicious code in fortunate-purple-gull (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88da381262350f4dcce284e6843b6eaddf3a9a5e651dcb0e597d9b86213bb3ab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...