The beautiful_macaw_z3n npm package is part of a malicious campaign linked to tea.xyz token rewards. It contains autopublish scripts that automatically generate and publish derivative packages with randomized Indonesian-themed names. The payload modifies package.json files to remove private flags and change version numbers, enabling continuous republishing of variants. This activity pollutes the npm registry and inflates developer reputation scores fraudulently.
The npm package bayu-teh15-sukiwir is part of a malicious campaign linked to tea.xyz token rewards. It contains autopublish scripts that automatically generate and publish derivative packages with randomized Indonesian-themed names. These scripts modify package.json files to remove private flags and alter version numbers, enabling continuous republishing of variants. This activity pollutes the npm registry and inflates developer reputation scores fraudulently.
The npm package bayu-takokak39-sukiwir is part of a malicious campaign linked to tea.xyz token rewards. It contains autopublish scripts that automatically generate and publish derivative packages with randomized Indonesian-themed names. The payload modifies package.json files to remove private flags, change version numbers, and continuously republish variants, polluting the npm registry and inflating developer reputation scores.
The npm package bayu-tahu99-sukiwir is part of a malicious campaign linked to tea.xyz token rewards. It contains autopublish scripts that automatically generate and publish derivative packages with randomized Indonesian-themed names. The payload modifies package.json files to remove private flags, alters version numbers, and continuously republishes variants to pollute the npm registry.
The npm package bayu-soto31-sukiwir is part of a malicious campaign linked to tea.xyz token rewards. It contains autopublish scripts that automatically generate and publish derivative packages with randomized Indonesian-themed names. The payload modifies package.json files to remove private flags and alter version numbers, enabling continuous republishing of variants. This behavior pollutes the npm registry and inflates developer reputation scores fraudulently.
The bayu-serabi76-sukiwir npm package is part of a malicious campaign linked to tea.xyz token rewards. It contains autopublish scripts that automatically generate and publish derivative packages with randomized Indonesian-themed names. The payload modifies package.json files to remove private flags and alter version numbers, enabling continuous republishing to inflate developer reputation scores and pollute the npm registry.
The bayu-semur58-sukiwir npm package is part of a malicious campaign linked to tea.xyz token rewards. It contains autopublish scripts that automatically generate and publish derivative packages with randomized Indonesian-themed names. These scripts modify package.json files to remove private flags and change version numbers, enabling continuous republishing of variants. This activity pollutes the npm registry and inflates developer reputation scores fraudulently.
The npm package bayu-sate43-sukiwir is part of a malicious campaign linked to tea.xyz token rewards. It contains autopublish scripts that automatically generate and publish derivative packages with randomized Indonesian-themed names. The payload modifies package.json files to remove private flags and change version numbers, enabling continuous republishing of variants. This activity pollutes the npm registry and inflates developer reputation scores fraudulently.
The npm package bayu-sasag67-sukiwir is part of a malicious campaign linked to tea.xyz token rewards. It contains autopublish scripts that automatically generate and publish derivative packages with randomized Indonesian-themed names. The payload modifies package.json files to remove private flags, alters version numbers, and continuously republishes variants to pollute the npm registry and inflate developer reputation scores.
The npm package bayu-sasag24-sukiwir is part of a malicious campaign linked to tea.xyz token rewards. It contains autopublish scripts that automatically generate and publish derivative packages with randomized Indonesian-themed names. The payload modifies package.json files to remove private flags and change version numbers, enabling continuous republishing of variants to pollute the npm registry.
The bayu-sambalado97-sukiwir npm package is part of a malicious campaign linked to tea.xyz token rewards. It contains autopublish scripts that automatically generate and publish derivative packages with randomized Indonesian-themed names. These scripts modify package.json files to remove private flags and increment version numbers, enabling continuous republishing. This behavior pollutes the npm registry and inflates developer reputation scores fraudulently.
The npm package bayu-rangi52-sukiwir is part of a malicious campaign linked to tea.xyz token rewards. It contains autopublish scripts that automatically generate and publish derivative packages with randomized Indonesian-themed names. The payload modifies package.json files to remove private flags and change version numbers, enabling continuous republishing of variants. This activity pollutes the npm registry and inflates developer reputation scores fraudulently.
The npm package bayu-rangginang79-sukiwir is part of a malicious campaign linked to tea.xyz token rewards. It contains autopublish scripts that automatically generate and publish derivative packages with randomized Indonesian-themed names. The payload modifies package.json files to remove private flags and change version numbers, enabling continuous republishing of variants. This activity pollutes the npm registry and inflates developer reputation scores fraudulently.
The npm package bayu-papeda63-sukiwir is part of a malicious campaign linked to tea.xyz token rewards. It contains autopublish scripts that automatically generate and publish derivative packages with randomized Indonesian-themed names. The payload modifies package.json files to remove private flags and change version numbers, enabling continuous republishing of variants. This activity pollutes the npm registry and inflates developer reputation scores illegitimately.
The npm package bayu-oncom53-sukiwir is part of a malicious campaign linked to tea.xyz token rewards. It contains autopublish scripts that automatically generate and publish derivative packages with randomized Indonesian-themed names. The payload modifies package.json files to remove private flags and changes version numbers, enabling continuous republishing of variants. This activity pollutes the npm registry and inflates developer reputation scores fraudulently.
CVE-2025-41001 is a stored Cross-Site Scripting (XSS) vulnerability in SOPlanning version 1.53.02. It arises from improper validation of user input in the 'LOGOUT_REDIRECT' parameter via a POST request to '/soplanning/www/process/options.php'. This flaw allows a remote attacker to craft malicious input that, when viewed by an authenticated user, could lead to theft of session cookies.
An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code execution.This issue affects ShowDoc: before 2.8.7.
Langflow versions prior to 1.3.0 are susceptible to code injection in
the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary
code.
A missing authorization vulnerability exists in OnTheGoSystems WooCommerce Multilingual & Multicurrency up to version 5.3.6. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized actions. The vulnerability has a medium severity rating with a CVSS score of 4.3.
Multiple security vulnerabilities have been identified and fixed in Mozilla Firefox and related products, including a race condition in permission assignment (CVE-2024-6601), memory corruption in thread creation (CVE-2024-6603), and memory safety bugs (CVE-2024-6604). These issues affect Firefox 128, Firefox ESR 115.13, and Thunderbird 115.13. Red Hat has released security updates for Firefox in Red Hat Enterprise Linux 9.2 Extended Update Support to address these vulnerabilities.