MAL-2025-53759 Malicious code in iwan-kepok74-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 532e19ab755815054b0b7043fbdf6671cb933d1996cb2f08252334ac34665eac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nina-keripik26-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 319bd35c0178d5597b447f53a84e3358d1baf2b48bc9ab0c8765e05518090aae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mulyono-mieayam82-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c63752a07fe1e06aba85c5c2ce83668176d487d82005550aa35d549273d0c49 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nina-empal96-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c092680e9204f30f97eeec5d6dc1102d297eb9dc874ba02aa5a950a7b2f0e2fa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mahesa-enting19-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f81bd882f432d4190739e74cb687cde85be2edb122a8fcd107cfe75930b75172 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-52768 Malicious code in gita-moci73-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d125b189b2618391871137eba3eb16b76dfdd042601e74be7926453cac3098f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in joko-sasag58-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d94d1700d698dbad877b440b74b055cd144b57308c890b47008c93e631eb56aa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-53415 Malicious code in nadia-mangga70-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc31ab2117949d0aea2d6ec09ad5953388b3ea6972662e502b354f5bae19d190 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-53356 Malicious code in maya-martabak60-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89437fd0284dcd3a40d58269234df3e894e0b685a26f79414e09009288d5c7f0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-52857 Malicious code in hanafi-gandul18-wekto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ecd014de3a16c9a05fdb1a084f322a422ea77df07fc91f8100d91fff559536b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vida-lodeh27-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60b25b99b6305f5cc9d4f6bf8f424d9bf1e31166af921d197f43a08a048ebd5b The package vida-lodeh27-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

Malicious code in eka-dodol98-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33d5adc2d420a8121c6eea171885720168a977b0980153fddda40355d8897399 The package eka-dodol98-breki was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

MAL-2025-50009 Malicious code in candra-otak-otak39-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13f37e17fe8d200ffdb4e8cd567d72bd6f32deaf84e0a6ac73439b7147ba9b0f The package candra-otak-otak39-miaww was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

MAL-2025-50863 Malicious code in arif-nasisayur82-kyuki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a7a67bf461f20d0941fae64b7328e89a889b4d5fee11e026a6b8cb330c954ec The package arif-nasisayur82-kyuki was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

MAL-2025-49957 Malicious code in budi-nasipecel9-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 112b372ca6e2d98ee850acba857cc2d22fcfbe478eea4ae1a53a2a1225763d9d The package budi-nasipecel9-breki was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

MAL-2025-51304 Malicious code in cici-rangi92-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af7f234874c83fc78be0a9b84f6f9870d3009cc43a596662eb368f20b0598c33 The package cici-rangi92-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

EUVD-2025-37836

EUVD-2025-37836...

EUVD-2025-37621

The Label Plugins plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This is due to missing or incorrect nonce validation on the labelpluginsoptions function. This makes it possible for unauthenticated attackers to update settings and injec...

EUVD-2025-37653

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Xcode 26.1. Processing a maliciously crafted file may lead to heap corruption...

MAL-2025-48691 Malicious code in hyatt-residential-roster (npm)

Package is malware. Collects and exfiltrates sensitive data to an external server. Suspicious install scripts execute the same script multiple times. The package communicates with a domain associated with malicious activity...