MAL-2025-162957 Malicious code in nokire-loklok98 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 633891d78d2a9b759d2b4261c3b5769b9855fe7c58f80d8e6e834e06a68925bd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nustar-miuyu-nutyu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 781394f4441e224aef80d9354d5dd5d965204f1ab0ae7354ddf398f5d141d7d9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-151431 Malicious code in abina-mibiian-upamumia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfde9531458c2c2f865acbd3a7558e02c4f903cb7d6fc3cf74956c03debc80bf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rita-87 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1301e2e36977c2409ac4e031f147b671d6d311e62bc38f2e6c158cf438ac276b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-152939 Malicious code in astia-ala-maol (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 551b56a410e718a0c1af155f10297eaa768fef682989c6c25e52d3300fc430ef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bitha-42 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89405cbd14c21e28bb2ea1edbd5c0c46c2ac5c36f3fc92568fb09c89d6fa992e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in private-ursa-terser-capella (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47abb987cd08fe5852b5353d6df36fa014ad21132b90c0057673328d713fdb7d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spinner-node-config-sync-grus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c53e550c282796bdb8410e7fc43c015ffa0b924311c3921e6542818028eee58 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bunyan-quark-loop-celeste (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe676a6d3e7e3665526bef653839a527974f4af6ce865b9901c31d442682f32b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in async-sedna-prompts-less-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1eb88c2f8971fe4760ed74b9feeaace97081beccb982086fb14a92bb504a614c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in standard-ariel-umbra-eclipse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33f78b99517947736c3edd511ca3470cdb79ed23806f5e753f836dccc568ad8d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in titan-cluster-yakutsk-sedna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab45250d9d40c0388aebade6b47a021c64a31a23329c3bc89a86aa9242321f87 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rimraf-canopus-promise-janus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff23d07545c6bf65617bc3e8cda0cc53db851598795f0b98762db3ff60fef82e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in protractor-pipe-puppeteer-cressida (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1520db9615b2fc63260e5f7cfb5985768b9d26e4cfd00e1879c4fa2ce22d6bfb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gacrux-csv-capella-pulsar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 035fbdde3702132c67d8c9bf3ea4d22da6a144316add5677b5ab473faff9a5af This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fusion-cygnus-scripts-carina (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0da0f3ed82a6802e1032006ffa7496f3444868266e937a6df6c74d62d391362d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140034 Malicious code in blaze-uglify-js-schema-subscription (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f8d5f1ce6793923e6a5f433e28c137a347dd3e3071b1cfcf658b2ec25fcd7b7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12020

The Double the Donation – A workplace giving tool to help your fundraising efforts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping. This makes it possible fo...

Malicious code in wawan-kue7-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b93e97949e646e0e3cd5153cc068ab13f76d652f7a065ba1605caac6a429bead This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zul-ragi54-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3eb6d9aea4c6513cc24dca53c91e453d78b09b6d2a3007a0ce084edb6f98282c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...