Malicious code in joko-kripik18-sluey (npm)

Source: amazon-inspector 4abdfb2abf0515643d11833b7d8ff85c1f95cdf402be4a2798db966186775c01 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-kolak25-sukiwir (npm)

Source: amazon-inspector b809fc67667414f8f35b61f8c2f56bb3f3aba8868428a56762a5d265fa05604a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-klentik51-ruro (npm)

Source: amazon-inspector 46b5f85e6aa57f11ddb2d31f514803bd51ceb6e48c3ba7ed430d86dbfe6810f0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-klipo27-sukiwir (npm)

Source: amazon-inspector c3b25632cfe4b29dfa66f35302c92f8c8d00789bd38336c25323ebe389fc0f59 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-kolak18-miaww (npm)

Source: amazon-inspector 745008dd56ea28db1be6dc24e4893ce58bd93a88d4941e484e77e54f602256bc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-klipo19-riris (npm)

Source: amazon-inspector 5d80942af0da4c81db1b9a3452d7e00ce3cf573976b81f918e4a1fd5ebb3a3c4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-klentik22-breki (npm)

Source: amazon-inspector ff431897624d64f6d2804294c1bdf2205571f9424988ba8472aa7e045f838f7c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-klipo43-miaww (npm)

Source: amazon-inspector a525490153fd3d273cad3ae8adc417fe4f91f7270da10711994e7c73ac22ae5e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-klentik67-sukiwir (npm)

Source: amazon-inspector 33818947eb2415bfd8eca6365b7f779d4c0a2c33fa35e40d305a0923b210d031 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-klentik15-sukiwir (npm)

Source: amazon-inspector c1846c781ca2873fc2dd90345e3c462a828dce6f7394903fdc1dd9be48858935 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-klentik3-miaww (npm)

Source: amazon-inspector 17daab2ac6097a5b8df37212e2646ba7a245ef8e0bf10b437390f22ce67f191a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-klentik23-sukiwir (npm)

Source: amazon-inspector 34639aa77a065918bef635f943f58d535add041afbd40cfc73d6b84792745bae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-klipo93-sluey (npm)

Source: amazon-inspector 10874191e4d150da01b05cfbb1a2234fb4db6c6648fabdd623c86475cbd927a2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in joko-klentik90-miaww (npm)

Source: amazon-inspector 7c5f0978013787d4f708469b5ae22bd0be35230b6d93274b5f89cdcb4cfb3348 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious Package

Overview lazyhtml-scripts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

EUVD-2025-210927

The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone they can induce to submit a crafted request...

PT-2026-94261

Name of the Vulnerable Software and Affected Versions Element Pack Elementor Addons versions prior to 8.8.4 Description Cross Site Scripting XSS allows an attacker with contributor-level permissions to execute malicious scripts in the browser of other users. Recommendations Update Element Pack...

CVE-2026-88792: Improper Neutralization of Input During Web Page Generation

The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated users to store arbitrary web scripts which will execute when a user views an affected entry...

PT-2026-95179

Name of the Vulnerable Software and Affected Versions Brizy – Page Builder versions prior to 2.8.15 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web...

CVE-2026-92949: Modification of Assumed-Immutable Data (MAID)

vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze and vm.readonly protections. Attackers can use Object.getOwnPropertyDescriptor or lookupSetter to extract and invoke host object setters...