Malicious code in kurnia-kemplang21-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f69f7a1ff41b14f9940e73ac3968fd65833a3c3c950249b6d3bc33d28808106 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

WordPress Auto Amazon Links – Amazon Associates Affiliate Plugin plugin <= 5.4.3 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by Rafshanzani Suhada in WordPress Plugin Auto Amazon Links versions = 5.4.3...

Malicious code in moderate-aqua-marlin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a1b7dac0949d437dcfe21ba18295b461e2565b2120518c51dc0b3b6767196e8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cool-red-zebra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8184753473f86bfa6ce618d53ceefb38492f33d09c31543b608198058d9c91e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in possible-indigo-cheetah (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4e42f7bb2da584bb623dcfe3deb3d494474369a7511cc67c356e3647c5c6c27 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in modern-peach-quelea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 511c60a346d5b0bd892399ea8aab34dff5d543cadc59e1cd9f08d03bfd80cf8c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in useful-azure-pinniped (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85bfc30d5a463b7cccc464c99cf73c70eaaaa12c2e9f8a1e40441c81a80c8e6a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dynamic_gerbil_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0be82e339884d218c57d8edb77bc0d03618d84848837a041866fe45cfd908fc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pretty_pike_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2beb0e99ac57a2f3f1a2ad789194abd7c8dd8ea424dfeef257c391945eff26a6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gita-sate76-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddecba660f5097aeb87df027d2f24edcbdb35d33625150d641e5125bcb2f9b9d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fadhil-tapai63-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4be20d4499b98e6d79158608d4b080ad717bc932e79cf14f454e6ab54f9b754 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-63476 Malicious code in indah-klanting97-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0526d34d3bef4d31a476ece16ae53d45bc3a03a6c8faf009dbcb3f53d418ab1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-62829 Malicious code in erwin-soto72-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 657c2a0df441ed30828bb579b7c94819b13b10a960f13a75aa572b780f26b317 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vina-rangginang54-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10f5b194993eae1b62089fe0f9f8983376d88ee3bb46d2a21e1c12a1e6ce31db This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tiara-sego82-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3f078b44553e1977ae4eb7d4fcd66a730469d46246843ad69a3afbc53610edd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-46246

Name of the Vulnerable Software and Affected Versions Auto Amazon Links – Amazon Associates Affiliate Plugin versions prior to 5.4.4 Description The Auto Amazon Links – Amazon Associates Affiliate Plugin for WordPress is susceptible to unauthorized access to arbitrary files. This is possible...

Amazon Linux 2 : java-1.8.0-openjdk, --advisory ALAS2-2025-3072 (ALAS-2025-3072)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.472.b08-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3072 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product ...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-1282)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1282 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Check ssize for decryption and in-place encryption CVE-2025-40019 Tenable has extracted the preceding description blo...

Amazon Linux 2 : nerdctl, --advisory ALAS2-2025-3070 (ALAS-2025-3070)

The version of nerdctl installed on the remote host is prior to 2.1.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3070 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6 addresses...

Amazon Linux 2 : amazon-ecr-credential-helper, --advisory ALAS2DOCKER-2025-079 (ALASDOCKER-2025-079)

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.10.1-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2025-079 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted value...