PT-2026-23531

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.2.14 Description OpenClaw versions before 2026.2.14 do not properly validate TAR archive entry paths during extraction. A crafted archive can use path traversal sequences, such as ../../..., to write files outsi...

Foomuuri 授权问题漏洞

Foomuuri is an open source firewall configuration generation and management tool from Foobar Oy. A vulnerability in authorization issues exists in versions of Foomuuri prior to 0.31, which stems from improper authorization and could lead to tampering with firewall configurations...

EUVD-2025-204434

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the software keyboard function hereinafter referred to as "keypad function" of Mitsubishi Electric GENESIS64 versions 10.97.2 CFR3 and prior, Mitsubishi Electric Iconics Digital Solutions...

Malicious code in planetology-phenomic-accretion-galaxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 965e1b0010f33e8ea2e875abf1ccba954eb7ad0cac0ccb41e741e8016b3b5690 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186770 Malicious code in enum-small-tau-sun-orchestrate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8590cf5441e83e5a96bcfa4a8cc7c6a41a36b4151991061636a57ca05f6f9de7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tethys-geodynamo-mongoose-venus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 384f86bbea9a17c8c4c1cab9ac42af48a2f7da03267231823fb3b4ce4c94df69 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jovian-sass-loader-native-cassini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 225deea9531693f6cbd7d6edd3656452b2959b26fd0b8a748ec2e08d0dbcbb98 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-169403 Malicious code in tusaaya-ss-rfe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c2e62a2fa5e268f9472d602300cbff484252b79aeba458ea1703fdad9e9d89f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-158793 Malicious code in lookingan-namala78 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd262f0ef9b4ad3847157e77c001de4f7c2b161c746edb35feabfc83cc17760c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149973 Malicious code in @mipta1/azxsxaxfsix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8edefc8076da738a0e16418f228905e84a094f57dccbb13806222227458483ea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aril-69 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd2d76d8d1aa5a8f9a0c67da653040707d9f64f26dd38ab8570ffb4d407455c8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sabua-muuyfaafu-dafumfufa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43df556eedf330bb0c4d05ab2bc74c7343eee4e051879d567b3c71c6149a8e8d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pino-pretty-yonder-wasat-lyra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6ed24e27e227c31ca5b8b56ecb0418c407903952c4a6f2893bb942e28fe75ab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144296 Malicious code in leda-style-loader-pyxis-izar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eaec0232e4a46f48d132b5c24d990bc8257f4d2882219fe80a1de80736883a5a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fauzi-kolak32-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 982de8c6f0ca4fd00d4d88165db612329dbe154a7b096010e147932583c0e753 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in quiet_bobolink_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7adb933fc3f5274e1b03b6b319db8ab2b600472e5519ef1326f8c64b5a284626 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dono-ragi93-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5b8d507ea7fe8d72162747dcd747a4ef8487aaf984637763c042be5b570db56 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-122737 Malicious code in qori-brengkes55-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b4835a0fa1fad1bf020d6a3e6dceb4410eaeca12d1f4f35938c9f100793326c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-121217 Malicious code in kiki-ongol-ongol61-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3d1d4a314de7b58cfa823885356e33acbcaacdbf82dc28688a71bbe1e10094c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-119359 Malicious code in delicate_wombat_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a8955ae56d5ed66622d5badecc3d412cc02a3f47198855f15f5b91fc1ad5072 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...