MAL-2025-181309 Malicious code in @akunsansan0/karedok38 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bfa20b7eef916345f63ba2a71152bcc6ba953e37d026528f05de8dfcc911309 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-181429 Malicious code in baso7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bda593797387a43621cb93594afbed039c8642a6c2a7fb84dcf960a9b99f7eee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-181206 Malicious code in @akunsansan0/biru20 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa1e1b160400efbfcb53bf16b9e4695a84845cb17097a0eec9fe33d19febfe94 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-64429

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator pcg32 to generate cryptographic keys or...

CVE-2025-64429

DuckDB 1.4.0–pre-1.4.2 encryption implementation is vulnerable due to multiple cryptographic weaknesses: insecure RNG (pcg32 fallback), possible memory wipe omission (memset) leaving secrets, and header manipulation could downgrade from GCM to CTR, bypassing integrity. There may also be unhandled...

EUVD-2025-150399

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator pcg32 to generate cryptographic keys or...

CVE-2025-64429 DuckDB Encryption Crypto implementation is vulnerable

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator pcg32 to generate cryptographic keys or...

CVE-2025-64429 DuckDB Encryption Crypto implementation is vulnerable

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator pcg32 to generate cryptographic keys or...

Malicious code in teate-thy-sonic-ucago (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25ed463db1ff2c95238ef51d6bfffd1616f9258f958587db94b3855cfa9758e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-vewhos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7adcda3ba4cc95e91a46fc26f6d1a5cbd2bd51e60b9f4e4f345553b4a149c156 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kisut-fig-dn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1decb83133518a36c3afa019cff615daec82cde0b9b58d6275e2abea9ebbd4e8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lookingan-nanakila41 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23a3e781d2dae1c1493f158976f4194fa70c816ad4e0027aab90423cc419756e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-kagig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 650d59975b59ea1ba3163e78ed546e62b13e1dd50d42a302d1034ae9de3573be This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-tufu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b37300bfd7ced2dadc2de59a0889de062e980cfe35338b38f96390409b928620 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-jamro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7bf47825e1a6ad846597c20038caf6b4aa91b84ea6c566a0fb23412cd53f3ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-ramjak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2095c16421ce579f4e386ecba1e0e8702d97973855e25cb8028b42b1d83c264 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kisut-fig-dfyn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70e18ec0e713b98f1631dc420defb056b0e3de1224e8b72e78a00f56de127921 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-ille (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7a771b5c0162fad6eef1f7b59bfd140cbb973006fca2fc246a9fafcf96b1cfb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lookingan-jeje24 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9dce0d41338b4716e90fcfe15849d3f0296cc2d8f0c824c6cc64ae076ae3f94 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lookingan-nanakila65 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f719ab2f2b0940eaa222f9537f73ec49f1a98abf108c250e0f12499e618cef8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...