MAL-2025-149671 Malicious code in xenon-warp-luna-perseus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9ed97c2aaeb7c26b8e9eceef631438c73865ab60574f693b31a7d75e2709ba7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143391 Malicious code in hugo-mini-css-extract-plugin-phoebe-chakra-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f18afccd285374f9ada3168fbd719d912e5bd5deb70f888163e90a782cb3e52a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141649 Malicious code in dione-sails-quantum-miranda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db51de8b02e4365c3c2f3c22204587df64fb6bbeaf96792762351d9a753d3f91 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149679 Malicious code in xenos-gridsome-start-titan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b803824790abb3a2c7df66fb5fc2f1b0dac8a77b5bdee59ede4cc7b02092a0ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139543 Malicious code in aquarius-ophiuchus-jabbah-eridanus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed45d85bd433fe100d93b3021befed9243cdeff4d84452c902fd82a43ea43e91 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144314 Malicious code in less-loader-centauri-subscription-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea8358fbb12d3db96e025bbe6eda5a0ccc017c35f9a7f8dfc51a6dce33f9cd71 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140060 Malicious code in blitz-solis-mdx-pegasus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eac0a972116745bee47e642e59aeb49f9ef45e7048afbf60a8face542146c8f4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144328 Malicious code in less-loader-quantum-miranda-html-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f72622ee9f60adeb5f780beefca8e1efd2fb397f3f46dc1ae0ab8ef0a1b15de This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144458 Malicious code in lint-staged-gridsome-less-loader-standard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98a7c959df4560a355bfcd68e15080007566b2e99e74162477598c165db3994c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149462 Malicious code in wezen-mira-morgan-indus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aced490826c2d7edbe824a07a4bbed1a8ee680171c14127269d06d326744906a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142136 Malicious code in equinox-spectron-less-loader-meteor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a6c1f15bfa8b9ceed404f696d7d67708cc87536091aebab7814c7dfc538e968 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141242 Malicious code in cressida-scorpius-prettier-plugin-markdown-ursa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a773fc88c2d9b6ab604714c0d75d5111b14f44c40a5b5b8f98e02f191aaa20ac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147805 Malicious code in selenium-hercules-hapi-pegasus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76a93dbc52222f7b0a214d14b4605326eb5080c043234c729e07c3340b0436b4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142359 Malicious code in exec-publish-fork-phoebe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a71c92771c825f5e91e41b1fcb1c89a8cea694ff25a8e4a0db76b1a37b2d697 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146560 Malicious code in process-nashira-alphard-dotenv-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d892e0621ffd010621c749e7224836ac446d06f96c997e37d0d3e3eb69033e4a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140359 Malicious code in canopus-hermes-postcss-loader-xanthus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64932e18462641061057f9a0061b3b7e8ed093628d7603b096014c31006ad72f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12637

The Elastic Theme Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a dynamic code generation feature in the processtheme function in all versions up to, and including, 0.0.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

MAL-2025-139155 Malicious code in shaky_egret_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dd5cd6e4b9659fadbfceeaadabe8b3c137cd2fcd97adaff2f97d46e62e1459d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in linear-blush-boar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a32f6df09387d966b3d14c2deb992251c6e5e285791c8d546a0b6510a4462340 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bumpy-azure-hawk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c5f81245c095a0db2baf7931861ca5afe91e1f67699c5758ac97ac1111fa71f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...