CISO's Expert Guide To AI Supply Chain Attacks

AI-enabled supply chain attacks jumped 156% last year. Discover why traditional defenses are failing and what CISOs must do now to protect their organizations. Download the full CISO’s expert guide to AI Supply chain attacks here. TL;DR AI-enabled supply chain attacks are exploding in scale and...

Cisco Finds Open-Weight AI Models Easy to Exploit in Long Chats

Cisco’s new research shows that open-weight AI models, while driving innovation, face serious security risks as multi-turn attacks, including conversational persistence, can bypass safeguards and expose data...

kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466)

In the Linux kernel, the following vulnerability has been resolved: x86/xen: don't do PV iret hypercall through hypercall page Instead of jumping to the Xen hypercall page for doing the iret hypercall, directly code the required sequence in xen-asm.S. This is done in preparation of no longer usin...

linux-pam: Linux-pam directory Traversal

A flaw was found in linux-pam. The module pamnamespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions...

kernel: xen: Xen hypercall page unsafe against speculative attacks (Xen Security Advisory 466)

In the Linux kernel, the following vulnerability has been resolved: x86/xen: don't do PV iret hypercall through hypercall page Instead of jumping to the Xen hypercall page for doing the iret hypercall, directly code the required sequence in xen-asm.S. This is done in preparation of no longer usin...

Malicious code in violent_cobra_emerald-6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 894b1cd630dd85385aeb6cb89ea36ec3bcbe44597561ad747718279bcfa356d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in responsible_aardwolf_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6a9ec1ffb9852d245687b79f59cd345d6efac4ce6649a13046051ae64f81588 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-101738 Malicious code in dorsey-tea-archive (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc59ff8200322e35413e0028ffced73e4ef5c9626a8f5745168f83d0009b8377 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-104545 Malicious code in jeromy-tea-archive (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b370c5de2ad5dbb235a63b6a9d98d98795588ce73a42c7a8eeb5257b57c131a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in unexpected_ferret_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57d444aa30576e535b709b2ce1fa2fe20e37ef02f8871cbe511dffaafce929f0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rudi-esdoger45-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27affeb1c607a73debbcc69fa0cfd3a13b755065b950dde59492a29e895c4139 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in worthy_aardvark_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4113da2d5afd4b6a9f3cf64d1e8ea78a4bb531e86f988f88f39d2c149f08f968 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-94830 Malicious code in historic_impala_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7ea7b72d32757ad237ea550fa051714c4d0c0f82e91eb0555209c5d3c4da48b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xenogeneic_skunk_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 134fe37c81b78693c5e125fea902c63cb143d761a7bd4d9e3b07ee2315f0cce0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wild_badger_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e073b3270eff117bacae7994327170a6a7830627a55f2a72b8f572ef86899758 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cindy-jamblang51-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c07cc90108aa81cad5b7d519cc86a7cdcfc730d6c278ed00cb34d985e2d8698d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-85949 Malicious code in gita-keripik6-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78bac4360940e7cf4b5d17a5386d5ded9fc4044657fbb2bdca40580d10d3e72c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-91901 Malicious code in vina-kue92-apidev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08b1352fbe320d42edf9b9592b22f0e006dffe8221953862a418b9b85ed96c5d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kiki-lutis63-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30f6c8eabcc0071b6cea673c28c7a97aa4b832e95ea076b72fca21caa3612549 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in patria-dodol82-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5aa84d6f753707181c9e9b43751ee88b2736fd9161aac369eec30e3e20f66af0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...