MAL-2026-4074 Malicious code in @antv/narrative-text-vis (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-3954 Malicious code in @antv/g-plugin-svg-renderer (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-3866 Malicious code in @antv/d3-interpolate (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in @antv/g6-ssr (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

Malicious code in @antv/g-dom-mutation-observer-api (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-3905 Malicious code in @antv/f6-plugin (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

MAL-2026-3948 Malicious code in @antv/g-plugin-matterjs (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

[SECURITY] Fedora 42 Update: timg-1.6.3-5.fc42

A user-friendly terminal image viewer that uses graphic capabilities of terminals Sixel, Kitty or iTerm2, or 24-bit color capabilities and Unicode character blocks if these are not available. On terminals that implement the Sixel protocol, the Kitty Graphics Protocol, or the iTerm2 Graphics...

[SECURITY] Fedora 43 Update: timg-1.6.3-5.fc43

A user-friendly terminal image viewer that uses graphic capabilities of terminals Sixel, Kitty or iTerm2, or 24-bit color capabilities and Unicode character blocks if these are not available. On terminals that implement the Sixel protocol, the Kitty Graphics Protocol, or the iTerm2 Graphics...

TencentOS Server 4: kitty (TSSA-2025:0486)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0486 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Malicious code in kitty-teadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector faa17cdd5c6055b304f7eff807383ba554eb6eadc8e759939d67095084dc7d64 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-76464

Malicious code in kitty-teadev npm...

MAL-2025-104834 Malicious code in kitty-teadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector faa17cdd5c6055b304f7eff807383ba554eb6eadc8e759939d67095084dc7d64 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2015-7772

Malware in sbrugna...

EUVD-2020-23271

Malware in sbrugna...

EUVD-2014-5582

Malware in sbrugna...

EUVD-2025-14660

Malicious code in bioql PyPI...

EUVD-2022-44530

Malicious code in bioql PyPI...

EUVD-2024-22365

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2025-43929

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - openactions.py in kitty before 0.41.0 does not ask for user confirmation before running a local executable file that may have been linked from an untrusted...