Malicious code in abuylbani-nikubamia-luahuubi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d6b2c3e995fd3718dfe784d17a3d4aee2aee6228cd96be1165eab590623906b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-163705 Malicious code in nudela-aafof-gafi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1404cb1c2c3bd5a66d13e91931ac180faa4d79a80000142b715dac00ec111ff9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in native-backend-dotenv-safe-mongodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 781f6d6927036e8ba7935aa91fcf468079fe5edef66c51944922fd9b13d986e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in configstore-prettier-css-loader-neptune (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb9b61611b12beafaab6b312ac0c7e46444736a1d2d38ba6ca30138be65e83ef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147942 Malicious code in sirius-config-levels-umbriel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dda37d8300529894192d4550cbebc8d45b72b09020b658596425e04f458a7a61 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143158 Malicious code in halley-ophiuchus-markdownlint-figures (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3607655a9434cf502c2fa60318a5328e80964eb1e771161aa48914888bf2f2f8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aurora-yildun-karma-xanadu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 002463a9ef23a3781a6864d5ad3a340c5c545b7720c5f79a22a9477e198d67d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rigel-less-lint-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0250b17d1e824b9261142e2ef10bcd989d933f1fe55d49cfd55a9fc7ff406bc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145758 Malicious code in oberon-xanthus-slides-farout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 564241ace50ae8cfeaf5ab8b4c943999f20cb66edf29bb7a2025370de13b0d74 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139034 Malicious code in spotty-green-mouse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 235b2d0ae78ab8ad8a86f5f1b00a821d6d7696dfa134f0f972d25217e09c3d52 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

UBUNTU-CVE-2025-40111

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix Use-after-free in validation Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmwexecbufprocess. All nodes are expected to be cleared in...

Malicious code in yanti-sambel5-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85e9956507a40549a3c75cb5f36fe2db1549da2fd490887f26af0678122ce85f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in okta-oblok90-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b829043a5167c11e06244b4be6c9e9f7623a79cb727d7013fd030ece2e9423c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in molecular_gull_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f4be6019ce947a4d607e0a10422e4df8db65d943752b55a9d75165d88ef3785 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138067 Malicious code in wibowo-semur49-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c97c1c70d0ab103dec26c464d864831e2a52d19b800f5e59764096d77111b54e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-49145

Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, a user that has enough rights to create webhooks mostly administrators can drop the database. This is fixed in iTop 2.7.13 and 3.2.2 by verifying callback signature...

Malicious code in wawan-otak-otak91-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60b9b364f9170f6e7ad4c970bddd383737274ea8cc161a29dae496cbbade3644 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-129298 Malicious code in partial_hippopotamus_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 081938676ae03c13032d2e58102d50a5eef5722315c0ae462b00d0f3df874709 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-130175 Malicious code in sinta-oblok88-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e29442b28315411659def6d9824823379881cb491a13e34a185edcb828bb1fc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in arif-kue20-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48d2acd879eb10d3c4f417b4c189fe3aabf073a001c53af8e81e79097facff84 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...