Malicious code in kurnia-saguer53-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e23aafe7570eb896509a651de80194dea75b914195b990bff155700706f7154 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-77150 Malicious code in candra-ketoprak48-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52cdf5da3a3cacf1706c3064edfba9e3a52493e5ace4f94a127ff841f1c09af6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zaki-sasag42-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8773a619b9caca0116b7a2bef038eb2d984ef27406b99c6ea48098b5e02673be This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in okta-gudeg79-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7987e24dfce8a415eda6594285be04595eea79f9d9d3b5c338db6a528d4f808d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in siska-gembus58-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10302767570ba37a177857a8d3f6370555aa8064cbe64a428819aa01f6aac0d8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rudi-klanting54-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dd87074475f3857f99c9d8ac30d316da735b09b6eccf7654a91715dc17871e1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-77350 Malicious code in citra-serabi15-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85a6f08fd8a6caec957b036ef6722f3e1202e45deefcae931a36eb73060f0692 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-76729 Malicious code in ade-papeda65-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4d1c7d1b3479b7ee456aac1747f23f4b9f58f3906a28e1cb5af3529b325560d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-77152 Malicious code in candra-kue29-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43dc40ec5531641736b82aef4a56c4155b5e2f6b4ed71d9595f71b8e62cf3849 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-79886 Malicious code in maman-liwet55-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5a4e35c5d5f6e8e21911bbe6debe25dbb9d2ae03c1a1e5413a4aee2ccd08a1a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-77187 Malicious code in candra-semur18-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cec2a012bdb3b6b26879de017c6a3a3173a935ddd08ac855d9025f8b0f691e83 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-79565 Malicious code in laila-kupang50-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d4ac506a08c4142742035f6335cb16f426f82df053e2b51f0c70ac40bd335af This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-82161 Malicious code in vina-lengko42-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 751eed1125cd7ddb71cda8a99e674e2fd010ec2d1fd8d260786b34da481780be This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-80389 Malicious code in ocha-rendang10-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d4b2100f2b3d3afb837504c851e28a824be7af5419cd32395fddd860cfa1008 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12126

CVE-2025-12126 affects The Total Book Project WordPress plugin (versions ≤ 1.0). Root cause: insecure direct object reference due to missing validation of a user-controlled key, enabling authenticated users with Contributor+ privileges to move/delete/create chapters in books not owned by them. Im...

CVE-2025-12126 The Total Book Project <= 1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Book Manipulation

The The Total Book Project plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0 via several functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access a...

CVE-2025-11532

CVE-2025-11532 affects the Wisly WordPress plugin (versions

CVE-2025-11532 Wisly <= 1.0.0 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation

The Wisly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.0 due to missing validation on the 'wishlistid' user controlled key. This makes it possible for unauthenticated attackers to remove and add items to other user's wishlists...

CVE-2025-11532 Wisly <= 1.0.0 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation

The Wisly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0.0 due to missing validation on the 'wishlistid' user controlled key. This makes it possible for unauthenticated attackers to remove and add items to other user's wishlists...

Malicious code in wati-rendang38-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76d742f6d73fcabba5ed942fa6eacb00d0179ebb1282ebb22d5d0e84fcc16577 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...