CVE-2026-109564 LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint

LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/uuid/duplicate that skips the read-access and draft checks enforced by getplayground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished...

Malicious code in lina-sasag48-miaww (npm)

Source: amazon-inspector 3d739f6676dc9189a851f46371b7dc2205115ec0bf7a35f270194564506d9c84 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in leda-phoenix-bellatrix-pegasus (npm)

Source: amazon-inspector ce266d563d5b2b900c4c7cb63fe1324d5f2f43ff6fca843bfff590fc2a4e0423 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in lala-poke5 (npm)

Source: amazon-inspector 25b5b33d1ca791ff61de91fdc6e86f06667042a247e903b4142a87c322c9af1a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in laila-telurtahu91-sukiwir (npm)

Source: amazon-inspector 00a953aff384e8bcb4c96b0ada97a8274c3c3effe9c41f3c68809e26cc5e070f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in laila-rangginang48-sluey (npm)

Source: amazon-inspector 11f266fa95aa3f489af10b8c431aa5f27176d296754b3d40dc59ff0cb612f212 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in laila-brengkes65-breki (npm)

Source: amazon-inspector 155a307e940d1df08a9541512bb27d56524f09a59fd14688aa7b58d55a2ba660 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in kurniawan-tumis17-sluey (npm)

Source: amazon-inspector 5a697012a4751d046e1beb5343f5b9606dd3cd507489e992937d297e6e54aa0f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in kurnia-moci26-riris (npm)

Source: amazon-inspector 03a8754711361ddf216e7a97a3b6bffb2310161ceec551f887236a7108b9d6bf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in kurnia-empal45-riris (npm)

Source: amazon-inspector cfb22b138cd4df958a43233f0dac4b36508fc71c96b583d30ec98b2f7dd9920f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in kresna-soto34-ruro (npm)

Source: amazon-inspector d378cdbf58a6a96e556ea22eca636e9aba3780c2df528cfbcd9d8fd2c487ecad This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in kiki-empal11-miaww (npm)

Source: amazon-inspector ae4fe82f4c4a4db825636a4b90839f4be8d1e9a7a23f3b729ddb2ba821539a93 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in kapvino-sofagfgdi-ugaha (npm)

Source: amazon-inspector 5e7bdff361910612ad5866f24d6bc26a53778ccaceac8dacdca8ed4fcb647b35 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in kapio-samunu-mvvma (npm)

Source: amazon-inspector b4802c4140b4039d2797145049a43df78b983bac55a0937152136a5162cb6826 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joyous_albatross_z3n (npm)

Source: amazon-inspector 3660a7c6c79d99beee09225439bf7c6d5098a3ca32b34b511d40a59e104e0e55 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joni-tapai45-miaww (npm)

Source: amazon-inspector c21adfab17a27b834c22d77d1d99d0da3e93172eb83035fb8ab831a9fa4dcc9d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joni-sate10-tititugel (npm)

Source: amazon-inspector aede608be06532896dfe681407427b6c74ce90492bb0f2f496d1ba2f9adafd1f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joni-rujaksoto61-riris (npm)

Source: amazon-inspector 884b60036bfc68a0ceba640d3370da8ae70b03275ab85721c315c21d836e81ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joni-ketan23-sukiwir (npm)

Source: amazon-inspector 1c6247e180bd5ce3d7a4553d22eea02f6b8055f5ad4dccbd749d1c728d43750f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-semur58-riris (npm)

Source: amazon-inspector 66405e4ab238d2ef183f3fde1560e015f8ec4a6e5f12b649d4aec5729be21a5b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...