MAL-2025-186324 Malicious code in corvus-javascript-charon-semantic-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b3ec6da952c946bcdb511cd68067f74a208ceba883ec29ce8802e9ca8e1554b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188592 Malicious code in pegasus-cache-passport-vortex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9dfec8b52297551b8c72f8706ea4a3412254e3aef5804f3ecfcd835d4237b6bd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-190431 Malicious code in yildun-blitz-miranda-accretion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9aa6adbd171001d6774e9c0faf6981e1b8230bc776079be2918fc0071a823fe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186027 Malicious code in cat-air-xi-slow-visualize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fefed3200aae9b03b2b7c8bfb5a00098ddc2ba15609c9a4286de08a7b8603e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187029 Malicious code in fornax-chariklo-sass-loader-parsec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 850e2c6c4023e5a4b443ad2f8ca4fad3529da5229a547813a31c34b4e139c1ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185675 Malicious code in authorize-interface-good-xi-sanitize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d85a36709ba2fdf12ccdbbb3a62be3d509127dd2bf12f9547d0c46a7016f02d1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189764 Malicious code in supernova-equinox-singularity-robotics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67f56679cc22b11e8ed02364f4ec1180760f81d8fab695bc66756a0de7aee591 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-53412

Name of the Vulnerable Software and Affected Versions ONLYOFFICE Docs versions prior to 9.2.1 Description ONLYOFFICE Docs contains a flaw that allows for Cross-Site Scripting XSS through the Color theme name within DocumentServer. Recommendations Update to version 9.2.1 or later...

PT-2025-46790

Name of the Vulnerable Software and Affected Versions Angel – Fashion Model Agency WordPress CMS Theme versions through 3.2.3 Description The software is susceptible to Stored Cross-Site Scripting in the profile media uploader. Insufficient input sanitization and output escaping allow authenticat...

WordPress Angel theme <= 3.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by WordFence in WordPress Theme Angel versions = 3.2.3...

Malicious code in itale-adci-yafiang (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95b8c921a1257fd724917b4f9bcccbc35f585ea7bcc744938192d9c7bccaccd3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gociay-ung-fugugga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50529d6b024ee5d08a7d009c7925dd2eda3e4777ddd73b1110cc9ed4503d9015 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in modasiv-kuvu-bavybu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eca077f9cdc45de8cdc9ed8b1586f1c2a97960f66b50fe2cdf626c15af78a31a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in itale-adci-akontolbapakmuullyfi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07be526858a961ca24ad2be94c49e05180a411e2a997ac3470f2332afd6fc432 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mugiy-ajoig-daitajk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a952cf9282e23a08ba9ff19ec953ca1b27cfe4abbaca938ea1ae685dc09f47cb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in imodiov-kufi-cuwabimagoli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67a162c9f48ed5b861afc11a9018d73037446a26f0c3e9c88f61542ea893ec83 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gociy-ng-gufaguagaci (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad6a9b6b0717d6550fcf161a8372dccab6b262ec945a2130e1ffe216ea0f9b54 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lobaic-gib-giga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 768445c5a75505d80e82f45ead562c007e3083a6e9c43e71df29fc1e0cc14cdc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lobac-ubb-avigyagu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a61903d7e2715b95d9139648a60f9f8c6e7dbc990e773635ce6942fc2a2a72f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in odasv-knu-boniv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cc2e6537efcb372df433c82b15487e0f848ba008378fdf03383a21fd0af32bb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...