MAL-2025-142359 Malicious code in exec-publish-fork-phoebe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a71c92771c825f5e91e41b1fcb1c89a8cea694ff25a8e4a0db76b1a37b2d697 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141649 Malicious code in dione-sails-quantum-miranda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db51de8b02e4365c3c2f3c22204587df64fb6bbeaf96792762351d9a753d3f91 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143234 Malicious code in helios-html-webpack-plugin-colors-achernar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15ca9906844a152840e647de99226967674d883cd6fd3e8fa73c798a11b93d04 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141581 Malicious code in dependencies-rimraf-local-gatsby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 054b2d956edf01f7319f62c077101349cd5044afb5c88bc418ae0072e0c3a095 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141242 Malicious code in cressida-scorpius-prettier-plugin-markdown-ursa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a773fc88c2d9b6ab604714c0d75d5111b14f44c40a5b5b8f98e02f191aaa20ac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12637

The Elastic Theme Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a dynamic code generation feature in the processtheme function in all versions up to, and including, 0.0.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

MAL-2025-139155 Malicious code in shaky_egret_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dd5cd6e4b9659fadbfceeaadabe8b3c137cd2fcd97adaff2f97d46e62e1459d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in linear-blush-boar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a32f6df09387d966b3d14c2deb992251c6e5e285791c8d546a0b6510a4462340 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bumpy-azure-hawk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c5f81245c095a0db2baf7931861ca5afe91e1f67699c5758ac97ac1111fa71f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138755 Malicious code in glorious-pink-hyena (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca66cba7a49e0510546cf9b5ea945ee6b4d7739adb038423cc8b23b1e01c981e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139043 Malicious code in stiff-brown-tuna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee3ae85ff263a468b58321cab55d214982761da6ae5fe69c7f6f8139b4e61d32 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138643 Malicious code in curved-rose-limpet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 624feaf1b0af54e728dc8e3b6c3c82b6954734b2d8718b93d9bacc8f5e0471f4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in systematic-chocolate-swift (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83d66d84fcfe28342c35ca4880f8e8c2c99807acdc60f3b9342d7ce0478641d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in overwhelming-lime-spider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9a0d2ce3084630b8aaaaa2ccee23d64366e300c6bde289088f5d116c6e2e395 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138935 Malicious code in pleased-chocolate-gamefowl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 874f1b9f8cd09a7220d567788a1aaf7dcc14772d94267485dc88dd46f55a08c2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138618 Malicious code in cold-azure-thrush (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34cd52b0166de72ca40e67be1e05b988770cd6030acc466099657a5a05dd5f05 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138846 Malicious code in loose-tan-bee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83426f6d8857b3e3e9fddffd79b800060ededb0ff10bd0a40fa8869a6a454aa5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in effective-rose-catshark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e118a10f0c55599ccf3867367e6398ed8a5180b40ecf9cc833d04ba1d4f7d592 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139095 Malicious code in varying-maroon-blackbird (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d532c4c516056ae0f4823fd186aa9df55ecff4f2fedd5d46ae96af890e43699e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

WordPress Angel Theme <= 3.2.3 is vulnerable to Cross Site Scripting (XSS)

Software Angel Type Theme Vulnerable versions = 3.2.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2025-10295 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 731931b06fd6 Credits WordFence Required privilege...