EUVD-2025-113328

Malicious code in galaxy-andromeda-non-blocking-xml npm...

EUVD-2025-116117

Malicious code in betelgeuse-jovian-galaxy-chakra-ui npm...

MAL-2025-142794 Malicious code in galaxy-semantic-release-auriga-norma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a48c9d3fed4f83d961b8702a5d20149d2721e2318a9e39ae8feaa081ad159467 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147169 Malicious code in rehype-galaxy-hydra-prettier-plugin-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae515cabdd377dc8f6e72c0e9f506b2e5ea246dca2b7ee74d12443ed287d875f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139573 Malicious code in arcturus-nightwatch-galaxy-remark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02934da1a26beaa527e0dc78a17b97871abc9faa5d6644b390f36b5ba820093d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142790 Malicious code in galaxy-karma-restart-wasat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64caec3afd9589b18de53d7cb1fa655578c4d3baa58c69faf1441ec3b4cf0ce2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144487 Malicious code in local-galaxy-css-loader-chariklo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62c5d995b2d7c1379c608222f6a930f1dd0abf83465e12d9acd14b9ec66aedfa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145422 Malicious code in nextjs-postcss-galaxy-triton (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5546276d3b6710db29e003e3d35096e0f4ec408654685b966043b94a6f2e55fe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-116529

Malicious code in arcturus-nightwatch-galaxy-remark npm...

EUVD-2025-114209

Malicious code in electron-builder-galaxy-xo-pavo npm...

Malicious code in eslint-plugin-galaxy-xml-canopus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7fa440b71749d145fde8a670cbb74a95100ff3d22173356b9d0dd9711ff2d10 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140233 Malicious code in bulma-venus-galaxy-quantum (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d2fb7f7af133dbbfc4e97be93b9c523d8332080995751877c6e8e1881fb53ce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142788 Malicious code in galaxy-csv-middleware-levels (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 265a90c0ed8d48568ce28902e224b77e7b8d7911333c8d1ab524cabdb671285f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146343 Malicious code in polaris-galaxy-dione-css-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fe89b18978b330a37b7d1dbdf56eadbf5e873ddc9b39a4676a80187c71923c6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

LANDFALL Spyware Targeted Samsung Galaxy Phones via Malicious Images

Unit 42 discovered LANDFALL, commercial-grade Android spyware, which used a hidden image vulnerability CVE-2025-21042 to remotely spy on Samsung Galaxy users via WhatsApp. Update your phone now...

Exploit for Out-of-bounds Write in Samsung Android

🔐 CVE-2025-21042 — Samsung Image Codec Remote Code Execution...

Samsung Mobile Flaw Exploited as Zero-Day to Deploy LANDFALL Android Spyware

A now-patched security flaw in Samsung Galaxy Android devices was exploited as a zero-day to deliver a "commercial-grade" Android spyware dubbed LANDFALL in targeted attacks in the Middle East. The activity involved the exploitation of CVE-2025-21042 CVSS score: 8.8, an out-of-bounds write flaw i...

CVE-2025-56232

GOG Galaxy 2.0.0.2 suffers from Missing SSL Certificate Validation. An attacker who controls the local network, DNS, or a proxy can perform a man-in-the-middle MitM attack to intercept update requests and replace installer or update packages with malicious files...

CVE-2025-56232

GOG Galaxy 2.0.0.2 suffers from Missing SSL Certificate Validation. An attacker who controls the local network, DNS, or a proxy can perform a man-in-the-middle MitM attack to intercept update requests and replace installer or update packages with malicious files...

CVE-2025-56232

GOG Galaxy 2.0.0.2 suffers from Missing SSL Certificate Validation. An attacker who controls the local network, DNS, or a proxy can perform a man-in-the-middle MitM attack to intercept update requests and replace installer or update packages with malicious files...