EUVD-2025-55703

Malicious code in beneficial-violet-llama npm...

EUVD-2025-55339

Malicious code in combative-jade-llama npm...

MAL-2025-66946 Malicious code in beneficial-violet-llama (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09045d37a8a389983f3c5dca68def225b6a14382e4d0f6c7ddbf373e2e176cee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-54357

Malicious code in federal-fuchsia-llama npm...

Malicious code in combative-jade-llama (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90542b7105c192894ed2ae9dbb4b05cba2a5ed0eca933fa5540056a463ebaf4c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-53372

Malicious code in male-tomato-llama npm...

EUVD-2025-54638

Malicious code in embarrassed-yellow-llama npm...

MAL-2025-70275 Malicious code in relative-gray-llama (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06aa9aba89ba62134e7339bbab7ca0b3f89781cc44406ff2e1694b36b5b2aa7e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-57368

Malicious code in semanticllamaz3n npm...

Malicious code in semantic_llama_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a2cbff433de2e0ed4696797847e2db454e9a146b480de5655c91134415eaab6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-65271 Malicious code in semantic_llama_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a2cbff433de2e0ed4696797847e2db454e9a146b480de5655c91134415eaab6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-50554

Malicious code in cognitivellamaz3n npm...

MAL-2025-59532 Malicious code in wicked_llama_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3aac910d2cb484ac471abaa04605b298dd92936d550cc9e8f5cbf60fb186f173 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-44443

Malicious code in wickedllamaz3n npm...

EUVD-2025-47806

Malicious code in experimentalllamaz3n npm...

Remote Code Execution (RCE)

Llama Stack is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper validation of parameters in the resolveastbytype function, which allows an attacker to supply malicious input leading to arbitrary code execution...

llama-prompt-ops (>=0.0.6, <=0.0.8) potentially affected by CVE-2025-12695 via dspy (2.6.13)

dspy PYPI version 2.6.13 is affected by a known vulnerability. The following packages have a transitive dependency on dspy and may be impacted: - llama-prompt-ops =0.0.6, =0.0.8 Source cves: CVE-2025-12695 Source advisory: OSV:GHSA-VVW2-H478-XWR3...

Scam Shield: Multi-Model Voting and Fine-Tuned LLMs against Adversarial Attacks

Scam detection remains a critical challenge in cybersecurity as adversaries craft messages that evade automated filters. We propose a Hierarchical Scam Detection System HSDS that combines a lightweight multi-model voting front end with a fine-tuned LLaMA 3.1 8B Instruct back end to improve accura...

Adapting Large Language Models to Emerging Cybersecurity Using Retrieval Augmented Generation

Security applications are increasingly relying on large language models LLMs for cyber threat detection; however, their opaque reasoning often limits trust, particularly in decisions that require domain-specific cybersecurity knowledge. Because security threats evolve rapidly, LLMs must not only...

LLM Framework Cache Poisoning

The vulnerability of the getcachedir function in the framework for working with Large Language Models LLM like LlamaIndex is related to the creation of temporary files with insecure permissions. Exploiting this vulnerability could allow an attacker to execute a cache poisoning attack...