MAL-2025-77853 Malicious code in eko-rangi35-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a354520240303a49f32be0b6448d560b11d7486c3cd8047015bdd02595afb08d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-81680 Malicious code in tight_egret_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e23935f734d8b93a7fcd7c3dcf83ed756324e3578964f427318555279578dbfb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-76847 Malicious code in andi-sambalado16-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 285cd3c87093f8929554a578454897eacd43707ff5035763751ea7d0df40d198 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-76969 Malicious code in bambang-tapai29-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3753be91c34ea588860050a775bc2783fa9f4cc114cd174e26d0e75d5983d89 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-81012 Malicious code in riana-soto61-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7284be00dd1b3b5210801771843171183381e2195d0382178a4cdd076f6a641f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-77042 Malicious code in bella-kripik11-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f52a346881a28a12e94dbd39fcd24054242ab29a53342577dad542a7fc9820b2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-80772 Malicious code in putri-ketoprak29-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ba90e667b8c16ed6b2bae19eb4105db7a4205dfa30924ea5a0d4b38f89f1380 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-82355 Malicious code in wibowo-lapis26-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6ea5e16507e43aa4916aae9f1058f088d678935ab1e3f931e9a88175d9fb785 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12637

CVE-2025-12637 affects the Elastic Theme Editor plugin for WordPress, with versions up to 0.0.3. The vulnerability stems from a dynamic code generation flow in process_theme that enables an authenticated user with Subscriber+ privileges to upload arbitrary files to the server. This could potentia...

CVE-2025-12637 Elastic Theme Editor <= 0.0.3 - Authenticated (Subscriber+) Arbitrary File Upload

The Elastic Theme Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a dynamic code generation feature in the processtheme function in all versions up to, and including, 0.0.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2025-12637 Elastic Theme Editor <= 0.0.3 - Authenticated (Subscriber+) Arbitrary File Upload

The Elastic Theme Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a dynamic code generation feature in the processtheme function in all versions up to, and including, 0.0.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

Malicious code in mahesa-brongkos74-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1e655129c765c78343b10e239943a3558c610acb3d5b6cea35fb76e4be71b25 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gita-bakwan1-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64da8c6451de5d3ebe901e60aae4125dacb8c1b84ae51a7fb9c7bd917c4ef560 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rina-mieaceh34-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebca541c6bb224e35bb346e8fc6ac252f19e6e2df846168fad45291b79c36938 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gita-mangut38-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87bb9c5cbf3d079ee671fe146f9c6c0bcec6c257c7a435fc75a5572df2dfb0f9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zaki-bubursumsum31-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5417a6bcb58c73b26b4537cf5bac822e8c384402241fcaa6abfff1e5f472990e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in irma-kupat50-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31dff09ffef2617cece852aa1e5f4c6b5c30be9652f762d15cbb6d5072bb514b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in erick-brengkes75-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba236b4490badfb2ee6d1da615e036d8e5cbea0005bb22b73b9cf9886e8f77f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gilang-tahu28-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 594dbc47fa764e62bf0b9a1dc766298370e7a73b1bf57e5e002a7e0d5b566aec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wibowo-bubursumsum1-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af05efb87921fde013e85b08e9efed97b332058af37a23b945cd1c5a3e5cb021 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...