PT-2025-46901

Name of the Vulnerable Software and Affected Versions TOTOLINK A950RG Router firmware versions prior to V5.9c.4592 B20191022 ALL Description A buffer overflow issue exists in the global.so binary of the TOTOLINK A950RG Router firmware. The getSaveConfig function retrieves the http host parameter...

CVE-2025-60699

A stack-based buffer overflow vulnerability exists in the TOTOLINK A950RG Router firmware (versions prior to V5.9c.4592_B20191022_ALL ) within the global.so binary. The root cause is the getSaveConfig function, which uses strcpy() to copy the http_host parameter from user input into a fixed-size ...

CVE-2025-60699

A buffer overflow vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592B20191022ALL within the global.so binary. The getSaveConfig function retrieves the httphost parameter from user input via websGetVar and copies it into a fixed-size stack buffer v13 using strcpy without...

PT-2025-47551

Name of the Vulnerable Software and Affected Versions Tenda AC21 version 16.03.08.16 Description A flaw exists in Tenda AC21 version 16.03.08.16 related to a stack-based buffer overflow. The issue is located in the file /goform/SetSysTimeCfg. The timeZone/time argument can be manipulated to trigg...

Malicious code in imodiov-koifi-cuidcg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d687eed4ffb353a798f717155ce5df7a920ae1166cae2af20ef04caf998d8ff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in flights-lutuig-alnaia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9ae3eaf7c599cd54d8f6ed569720a0093fe96e8a0e8252836cd007303838de6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in poliaoz-aiksdfo-alfdaasduggsdion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b53eef561f1b516428d1b7e17aecbde9bdb410de0bef3d46d1c4a294460a2417 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-181196 Malicious code in @akunsansan0/biru11 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4af0f72010a0a237fab8e29284f0ace502532814af2f000ccc263876c0a6e9f5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gun1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e39996ab245b744a18cc86ef786e37d389e5830144e272e9af07c90f6871a0ce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in riya-23 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 997e79affec697620be096b69d403874e8eb3fa14c1df8fe03eee548a954cbf3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-177484 Malicious code in poglymer-ognagh-agafaaammi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ad21a6d4ecb6f5d41b5a3e912ad86e6689f0d45a754d35d7f46176887955524 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in polymer-adag-aisihai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97f95e84311cb63c5d80a051fcf8ecd0bb9723ed94602f66f4f18353218836cc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-172670 Malicious code in aaku-lia-tea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 707693d731a613f7f78c218aae2d24f28bdbccb7b60871d44c7c8a312dcbfe8e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in abu-poke13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a18f4668ae37ad52a0caefd4abcdaf1aeb61dfb22fde4874edb7d85f89b0ab3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nokire-kore40 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0000140c3a3bc0594deb109b89a13656ce69ce9dbf86493d793103fa04490d53 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kuinsu-lubki-nasiuvnami (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ab47af665a864278f7dd8eba526dfbe1cd5257abf9b1c102925ee890cad3d77 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nabuf-ogof-dasi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 147506b8c5e5798f956df31d21df6e13821716f08f09118445d29a76bcba3844 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-169204 Malicious code in trevora-cir148 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2f3a95f960da234f9a36c7fb1ec7344858bc6ceae82ab5e9700f7ce64c68dbb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tehnah-nati-musrika (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 013ab4cde22ba06491078b37121aaa17f333d79b4f63df77ddf975f55ed83294 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kapafovgiaangapfao-safa-agada (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb0c7c7129441afc5e9760ccef837eb6a09d56bc6016b5775648769676186665 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...