MAL-2025-82025 Malicious code in vast_possum_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3fc7cd5fcb5b75166167bb4323c4417c0c9315e86741fa61707c3d9db916c1b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12020

The CVE-2025-12020 entry concerns the WordPress plugin Double the Donation. The connected documents provide concrete details: the plugin versions up to and including 2.0.0 are vulnerable to Stored Cross-Site Scripting via admin settings, caused by insufficient input sanitization and output escapi...

CVE-2025-12020 Double the Donation <= 3.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting

The Double the Donation – A workplace giving tool to help your fundraising efforts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.0.0 due to insufficient input sanitization and output escaping. This makes it possible fo...

Malicious code in budi-telurtahu30-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ffbd780b9a924c576f7cb8f8635ab885a3a1a0cf3cec55d33b0818bfa32eac0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in agus-ketoprak65-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4d14a6d716b24b2cb924f49da9b0f89e7ba866c21698088783d862153c2fa7a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in putri-rujak58-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55a4c97bf7e8780b6776412411047b06b9d1a09a41728c0e9d771983f5289c93 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zul-taiwan11-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 973f56d7da8cbf932c045e9bac480979dbcb371cbfef4aadecf7777d3819ddc7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spiritual-lime-yak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5c1a7bc12603a05eae6f51d99170667a8b6aea2a48bdc34820f60bc2e03f1f8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in amused-amaranth-rabbit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bee2473499d28da5714ae979c05142de9c12641c08508952f3a5b973d5179abb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-70484 Malicious code in scornful-aquamarine-mite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f36e99d51dc1724b07a561b9a7c3855a99554019830b1ebd50713f63709105ab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-69028 Malicious code in just-cyan-cockroach (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd5bd077c35cbcce3bc86744dbfa412196b4a11e95402eb66d69a580f69698e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bumpy-olive-asp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ba3a7ef21dcb8ddf18d4bd52e1a63f71d4cfa85d6f7f1d171cf2ecbccba8ff8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-69655 Malicious code in nuclear-silver-clownfish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9345a1b82d349dd5e2bacb59921d53bfbad93fc7ffdfeb6fa67a7db7b0025d81 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in determined-tan-hippopotamus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ece710a79ef7ed0cb6a35a009203f21db732ba96f9747655279fb6bb3febc7d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in irma-saguer54-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6540c445bc5106674966ac285618e591c498343b7f9b7ca5bb97949c67f3aec0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bayu-tempe19-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79f316145ebddb10191ca8ac0562cca4169e0b5c6789bcbeeb2adc460ccc8bd0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in redundant_emu_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b8ca808d27df6c7872e7e5b3394c1a398908c2dff80e1a68791bea4119237e2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-62725 Malicious code in eko-taiwan42-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5c579e540751f5af823299582063a92cc6f9b6f9ce169fd784a669cb19057f6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lutfi-nasi34-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8cab5176abe28c39559041d4841c00ac4b959475f0dd50f0c4164f998d4075e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-65205 Malicious code in rudi-ragi36-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2ba06fb9548d822f7cacfc96d77677cf63cde640543b4bef0134f05c3c0c01f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...