Malicious code in joko-klanting76-riris (npm)

Source: amazon-inspector 5c531cd590515103353048031ec60bd81e77aa8dee33c8106335d4219a8929b8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-kripik58-sukiwir (npm)

Source: amazon-inspector 55f68ad56fc436cc150da59acf5a3377a7f41dba8ec3388e0f73de62810b023f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-kripik18-sluey (npm)

Source: amazon-inspector 4abdfb2abf0515643d11833b7d8ff85c1f95cdf402be4a2798db966186775c01 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-kolak25-sukiwir (npm)

Source: amazon-inspector b809fc67667414f8f35b61f8c2f56bb3f3aba8868428a56762a5d265fa05604a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-klipo93-sluey (npm)

Source: amazon-inspector 10874191e4d150da01b05cfbb1a2234fb4db6c6648fabdd623c86475cbd927a2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-klipo27-sukiwir (npm)

Source: amazon-inspector c3b25632cfe4b29dfa66f35302c92f8c8d00789bd38336c25323ebe389fc0f59 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-kolak89-kyuki (npm)

Source: amazon-inspector c4ce591a4b886d058c3b4fb4f54dcf36e22102ca0d1385d848a296168959662a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-klentik90-miaww (npm)

Source: amazon-inspector 7c5f0978013787d4f708469b5ae22bd0be35230b6d93274b5f89cdcb4cfb3348 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-klentik51-ruro (npm)

Source: amazon-inspector 46b5f85e6aa57f11ddb2d31f514803bd51ceb6e48c3ba7ed430d86dbfe6810f0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-klentik3-miaww (npm)

Source: amazon-inspector 17daab2ac6097a5b8df37212e2646ba7a245ef8e0bf10b437390f22ce67f191a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-klipo59-miaww (npm)

Source: amazon-inspector b1f212dd394dc805edc9cb3c12324c35837008a046e70f0f96d4bc49b1723304 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-klipo28-ruro (npm)

Source: amazon-inspector 402e6d06e4911efa342ceff1f6cf23983ec30a6cd9647ba3eeb2571ee2c7c9da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-kripik37-sukiwir (npm)

Source: amazon-inspector dcfb0192d3019b7b70c513dff53cc72b93115678736e17e2a8fbf5c387b300f8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-klentik22-breki (npm)

Source: amazon-inspector ff431897624d64f6d2804294c1bdf2205571f9424988ba8472aa7e045f838f7c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious Package

Overview lazyhtml-scripts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

EUVD-2025-210927

The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone they can induce to submit a crafted request...

CVE-2026-88792: Improper Neutralization of Input During Web Page Generation

The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry...

PT-2026-95179

Name of the Vulnerable Software and Affected Versions Brizy – Page Builder versions prior to 2.8.15 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web...

PT-2026-94261

Name of the Vulnerable Software and Affected Versions Element Pack Elementor Addons versions prior to 8.8.4 Description Cross Site Scripting XSS allows an attacker with contributor-level permissions to execute malicious scripts in the browser of other users. Recommendations Update Element Pack...

CVE-2026-92949: Modification of Assumed-Immutable Data (MAID)

vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze and vm.readonly protections. Attackers can use Object.getOwnPropertyDescriptor or lookupSetter to extract and invoke host object setters...