Malicious code in nuilava-drae-naha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17e50aa127f0c0d68b5c67885366f53a703c73bb10d324892500b7d34b53fa96 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138181 Malicious code in yanti-bakwan75-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50f2c9712fc5213b5d8c5756529de2c02f4576a7947541194290b8a5892b66b5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cindy-tomat8-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6bf6116f4e63e0fca65943d0ac151091f1d3a9da54ba2b2908e83165e8fb595 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kiki-nasi33-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bfbd4f9c061bb1e9d568dce3db004d74890c446c9c8ab3f981cdf992708aafb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-116470 Malicious code in prospective_canid_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18b8184d6210c4e4d2efc51af929d6da4b33ed14e3310c57d18155d1d3174a01 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in oktafian-menjes29-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e528adff89ce0d50fb5eb22793ce5260aa47482543c3c48a097537101632aff7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in citra-gorengan41-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09c2368c422173114df33aa3f4c6b5895229011fca5c7706af453640e56dd6ad This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-97283 Malicious code in vivid_bird_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85b24778e683965e250eb68f37a739fe7a118d90df7861b2f1ae908653b8cb00 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in joni-otak-otak97-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5186dd8c2dda512fdc9d6e59b543ce84fcd34f6f15d40f3419d55a4f4d306c62 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in citra-tahutek88-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9824d6e0d6529777f867a9075befb93d71f0b43ddbec4cbc2e5222c4873388b7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in strategic_flyingfish_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a593b3fcacc31dc2503c2db4ecd67917ea5f71350902fad28f225f1eb5533d0b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gita-asinan11-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bba5166dd2777510eced389b179a3acf445cd0f9633a5b4e4a0b2e0eda3eb5c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

curl: Arbitrary Configuration File Inclusion: via External Control of File Name or Path

Summary: The Arbitrary Configuration File Inclusion ACFI vulnerability was identified in the curl utility via the --config option. This flaw is a form of External Control of File Name or Path CWE-73, occurring due to the lack of adequate validation on the user-supplied configuration file path. An...

CVE-2025-64322

Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files.This issue affects Agentforce Vibes Extension: before 3.3.0...

CVE-2025-64319

Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration Files.This issue affects Mulesoft Anypoint Code Builder: before 1.12.1...

CVE-2025-64318

Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration Files.This issue affects Mulesoft Anypoint Code Builder: before 1.12.1...

CVE-2025-64319

Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration Files.This issue affects Mulesoft Anypoint Code Builder: before 1.12.1...

CVE-2025-54863

Radiometrics VizAir is affected by a vulnerability where the system’s REST API key is exposed via a publicly accessible configuration file. Public access could let an attacker remotely alter weather data and configurations, automate attacks across multiple instances, and exfiltrate sensitive mete...

Salesforce Agentforce Vibes Extension 安全漏洞

Salesforce Agentforce Vibes Extension is an AI-coded agent extension from Salesforce USA. A security vulnerability exists in Salesforce Agentforce Vibes Extension versions prior to 3.2.0 that stems from improper neutralization of LLM prompt inputs, which could lead to manipulation of writable...

PT-2025-45031

Name of the Vulnerable Software and Affected Versions Salesforce Mulesoft Anypoint Code Builder versions prior to 1.11.6 Description An issue exists in Salesforce Mulesoft Anypoint Code Builder related to improper neutralization of input used for LLM prompting, which allows manipulation of writab...