MAL-2025-76969 Malicious code in bambang-tapai29-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3753be91c34ea588860050a775bc2783fa9f4cc114cd174e26d0e75d5983d89 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-80772 Malicious code in putri-ketoprak29-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ba90e667b8c16ed6b2bae19eb4105db7a4205dfa30924ea5a0d4b38f89f1380 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-82355 Malicious code in wibowo-lapis26-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6ea5e16507e43aa4916aae9f1058f088d678935ab1e3f931e9a88175d9fb785 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-79791 Malicious code in lutfi-rojak50-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81438927c841d69510c85829a2cf282b681c598be7d95e105d1d4b1d44802568 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12637

CVE-2025-12637 affects the Elastic Theme Editor plugin for WordPress, with versions up to 0.0.3. The vulnerability stems from a dynamic code generation flow in process_theme that enables an authenticated user with Subscriber+ privileges to upload arbitrary files to the server. This could potentia...

CVE-2025-12637 Elastic Theme Editor <= 0.0.3 - Authenticated (Subscriber+) Arbitrary File Upload

The Elastic Theme Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a dynamic code generation feature in the processtheme function in all versions up to, and including, 0.0.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2025-12637 Elastic Theme Editor <= 0.0.3 - Authenticated (Subscriber+) Arbitrary File Upload

The Elastic Theme Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a dynamic code generation feature in the processtheme function in all versions up to, and including, 0.0.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

Malicious code in erick-brengkes75-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba236b4490badfb2ee6d1da615e036d8e5cbea0005bb22b73b9cf9886e8f77f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wibowo-bubursumsum1-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af05efb87921fde013e85b08e9efed97b332058af37a23b945cd1c5a3e5cb021 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in irma-kupat50-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31dff09ffef2617cece852aa1e5f4c6b5c30be9652f762d15cbb6d5072bb514b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gilang-tahu28-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 594dbc47fa764e62bf0b9a1dc766298370e7a73b1bf57e5e002a7e0d5b566aec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vina-kue41-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3083190d8d538a1f185e6bfd7a4a3fd72c673d9ff734d411591fb467d95739d5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rina-mieaceh34-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebca541c6bb224e35bb346e8fc6ac252f19e6e2df846168fad45291b79c36938 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gita-mangut38-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87bb9c5cbf3d079ee671fe146f9c6c0bcec6c257c7a435fc75a5572df2dfb0f9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zaki-bubursumsum31-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5417a6bcb58c73b26b4537cf5bac822e8c384402241fcaa6abfff1e5f472990e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kresna-buburayam79-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15184f91904a696fe1cf50d70554449e77ac9fbf1b526b774fc9bff7a1a2987b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hadianto-serabi71-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa418ea00414e0b2b96111d1c918d1b31110473e207de1d5ac238989abcd8e5c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ade-empal38-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d746ddfdba3833b8266af625de3b7a003cd7009295d30c1a38e5ebb870e7192f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in qori-liwet72-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5777cd2954e8ff285e5d11e2b08d30fd5da179471b3dcd9fcc9ef6da228f0d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cici-lepet87-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2e8743000628f0e76d01be58099a1cb8256e29eac68d7782351b728b90c52e3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...