GHSA-HP3V-WP32-953H Cotonti: Cross-Site Request Forgery in the Personal File Storage (PFS) module

Cotonti 1.0.0 master branch, commit f43f1fc3 is vulnerable to Cross-Site Request Forgery in the Personal File Storage PFS module. In modules/pfs/inc/pfs.editfolder.php, the folder update action 'a=update' updates folder metadata title, description, public/gallery flags without calling cotcheckxg ...

Malicious code in entanglement-greatfilter-void-callback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5c938a40aa714464f758cf9b7ffb6b9ac75e1e0bfdfb7fa0e1b292f499d3135 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in octans-cybernetics-carpo-norma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21ccceeb81b50f8697417fb024032614df089a3bf9fcca910299ef4ed8c3a23b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186803 Malicious code in eridanus-antimatter-figures-dotenv-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc9f078e333a05d5703ffb66d84694f1b93317ddb74c0ff6cd1be5c855ec5899 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-182100 Malicious code in gocay-guga-visi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a1f20bd9cb0bc58e595f39c6399bedb6b92035d94ffa79e7a77d6889d61b1b9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185001 Malicious code in sonic-kig-tnadeaxav (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2c2a114c5b200cc356c8e268c640d22ee5c5bd25c7e8eabdc30dc31c5397790 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in unimna-safafi-naisffis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a89f9e9b5c97a52dd1b753de7d8e1397d162ec0a3a7bb6a48ce1795278cf695b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in seanobrien (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0a447fc9480dc3ed6a0a41e593ef9e764206fcb51907f736ec0b9b819c77911 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in suharta-poke53 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07da10e6ef21002f0d1c92e99b933f6f692d7efbeb5d6c670cdca9e9bead93a6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-168902 Malicious code in technical-alonbio-tolamaaikui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f8b074b4033ac5cf89841ba41d501577dfe306a653e6ac0ebf2a97eab7f82a6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mansila-tiafala-magololasaklani (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b6e86d4fd208e76e5e10e48729413b9fecbd22641230c43cd21d916b55588eb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lookingan-konami5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29f8a04be2893878a57534cc8f9fda250afb1907d99959388a5551efd4d5c2dc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-169223 Malicious code in trevora-cir3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bdd6c6aa977528d7278798336822ebd940adc4df13fb17cb3fb4e1f548cbd4f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in iomodra-foruai-unajai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9aa0065ca4bc7fbcc466392bc341a4896114a08edabd845e48ce83e2484aa5da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nokire-nakala86 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 123b6d5f86fbd59f2ba36898db05e421fdad9f7be7c465d49030ea3d6295a191 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in technical-albio-tolimr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d293cb8e35e146bcf3767dc0a03c97729ff1db3b374196adaa8028e55f131ba8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in munir-ert-nabfa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05830f618b9b164d2660324e4030997a105724e898bb7db583f4e54c4d2117d5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-170071 Malicious code in uinsu-technical-portal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d3778f1203e9f3b94b6f66d8ed5ebaac854937b54fe7ba1dccd2c5c4d2f8b7c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-152869 Malicious code in aril-67 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afd3a8a5a2c2a554ebf7715e600fefe73d812a122e7753a7ddd9070e4d6a99ca This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-168440 Malicious code in tealove-nanami12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b727a77f703fdcfc6388ac66e1709f116ef22a75feb33c74bbbda5341e72b609 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...