MAL-2025-149244 Malicious code in vulcan-lyra-cassini-local (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9be04eb363e087f81ffeeb3da0960053b654d947ebcd091091b9064bbffbfaa9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141581 Malicious code in dependencies-rimraf-local-gatsby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 054b2d956edf01f7319f62c077101349cd5044afb5c88bc418ae0072e0c3a095 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149209 Malicious code in vuetify-fork-xml-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 683777ffb6a0d2d4ffc0e742ec2bbcc49d9709fcb03df1612896d9e53e07165c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149462 Malicious code in wezen-mira-morgan-indus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aced490826c2d7edbe824a07a4bbed1a8ee680171c14127269d06d326744906a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141523 Malicious code in delphinus-leda-polaris-event (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f6c18328bd4bdbf2c3bc3fc6cd547b636261ffdd43a67ce494a8b2953a26355 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139679 Malicious code in auriga-install-express-toml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ec57c878f1c91a3125ce5d22ce4ca93c160d03d8b9c78e896caf971f7b8fb83 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142625 Malicious code in fornax-hermes-soap-eleventy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d020f29de3afe6cb948bf0aaf77863bd0e8e830591087dadf33cfbb7f2c86de This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149671 Malicious code in xenon-warp-luna-perseus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9ed97c2aaeb7c26b8e9eceef631438c73865ab60574f693b31a7d75e2709ba7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147496 Malicious code in rollup-ganymede-impulse-dagda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd4e423e4a8baa3cfbbd0fa2de90cc13372b6f2fee6ef4a79521af5809045b98 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143003 Malicious code in graphql-gatsby-aquarius-phoebe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e14047635487fb6f2384b47629b34b22e9f878ee9d1fa29e1f9ddda750bf3122 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149679 Malicious code in xenos-gridsome-start-titan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b803824790abb3a2c7df66fb5fc2f1b0dac8a77b5bdee59ede4cc7b02092a0ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146560 Malicious code in process-nashira-alphard-dotenv-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d892e0621ffd010621c749e7224836ac446d06f96c997e37d0d3e3eb69033e4a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143391 Malicious code in hugo-mini-css-extract-plugin-phoebe-chakra-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f18afccd285374f9ada3168fbd719d912e5bd5deb70f888163e90a782cb3e52a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12637

The Elastic Theme Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a dynamic code generation feature in the processtheme function in all versions up to, and including, 0.0.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

MAL-2025-139155 Malicious code in shaky_egret_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dd5cd6e4b9659fadbfceeaadabe8b3c137cd2fcd97adaff2f97d46e62e1459d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in linear-blush-boar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a32f6df09387d966b3d14c2deb992251c6e5e285791c8d546a0b6510a4462340 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bumpy-azure-hawk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c5f81245c095a0db2baf7931861ca5afe91e1f67699c5758ac97ac1111fa71f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138643 Malicious code in curved-rose-limpet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 624feaf1b0af54e728dc8e3b6c3c82b6954734b2d8718b93d9bacc8f5e0471f4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138755 Malicious code in glorious-pink-hyena (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca66cba7a49e0510546cf9b5ea945ee6b4d7739adb038423cc8b23b1e01c981e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139043 Malicious code in stiff-brown-tuna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee3ae85ff263a468b58321cab55d214982761da6ae5fe69c7f6f8139b4e61d32 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...