EUVD-2025-146218

Malicious code in yuda-26 npm...

Malicious code in fauzi-26 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10a12095182a4d7c7fd0f454ce97d3877d9dd2369da28bf3ac104d33371820d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ilop-26 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97c7b0d229753fe340bf1996cd6ff285fb2feb7e3ab86fe52b719f199bdae05b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

siddheshtea (=1.1.6) potentially affected by unknown CVE via manda-26 (=1.0.0)

manda-26 NPM version =1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on manda-26 and may be impacted: - siddheshtea =1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-159622...

Malicious code in manda-26 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec5e33cad1daeb0c62cfbf07f70f2d2095c327eff8bdddca193c980316f28726 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bitha-26 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad43c696cea4c48912194ad8be59b2d229784f158f5c4629294bc3a5e0808917 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-160810 Malicious code in muklis-26 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d92bb16e3e5bbdcb93f4d3c7ea39170c2610401253d6b90af3fa273d170fb925 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-153675 Malicious code in billa-26 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 502c0fe908bff8e308d882c0246ffef6b2509a51055716afc73f72840d6154f0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-156276 Malicious code in ilop-26 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97c7b0d229753fe340bf1996cd6ff285fb2feb7e3ab86fe52b719f199bdae05b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-164896 Malicious code in rita-26 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c4e5b1315488501727d5b706ef490366e2c51e7705384b6db7f8836fb46a0fc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155903 Malicious code in ican-poke26 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb9e678297ad648fa98255690310d05c74332787ffae69c627747f7810887cd9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-40169

creationtimestamp| type| source ---|---|--- 2025-11-12 11:57:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m5glvwvwcn2w 2025-11-12 14:00:57+00:00| seen| https://bsky.app/profile/jos1264.social.skynetcloud.site.ap.brid.gy/post/3m5gsrdfaptu2 2026-04-02 17:00:00+00:00| seen|...

EUVD-2025-74199

Malicious code in statisticalbatfuchsia-26 npm...

EUVD-2025-74178

Malicious code in surewildfowlaqua-26 npm...

Malicious code in sure_wildfowl_aqua-26 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9308bd4127015c1721724d6ce1ef9984bf305b72870b7b890a812f2479666e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-64513

creationtimestamp| type| source ---|---|--- 2025-11-10 23:26:01+00:00| seen| https://bsky.app/profile/jos1264.social.skynetcloud.site.ap.brid.gy/post/3m5crhcpklm32 2025-11-12 04:32:51+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3m5ft2xji4w2h 2025-11-13 10:04:13+00:00|...

CVE-2025-12112

creationtimestamp| type| source ---|---|--- 2025-11-08 05:45:26+00:00| seen| https://bsky.app/profile/jos1264.social.skynetcloud.site.ap.brid.gy/post/3m53vashd7pk2 2025-11-08 06:29:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m53xpqkk2k2x...

CVE-2025-43361

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26 and iPadOS 26, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. A malicious app may be able to read kernel memory...

CVE-2025-43345

A correctness issue was addressed with improved checks. This issue is fixed in iOS 18.7 and iPadOS 18.7, iOS 26 and iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An app may be able to access sensitive user data...

CVE-2025-43338

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26 and iPadOS 26, macOS Sonoma 14.8.2, macOS Sonoma 14.8.4, macOS Tahoe 26. Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory...