Malicious code in postcss-loader-fork-levels-venus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6eeb87c440bcb3eff380092f73c31bd01232d896ff500023793df85c072d0644 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in miranda-yonder-css-loader-hercules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8378467263bcd9a3bd8da17fda30d0ca889e2cdb63213a7c5b17da5e8173b472 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-121586

Malicious code in style-loader-resolvers-alphard-css-minimizer-webpack-plugin npm...

Malicious code in sagitta-zephyr-andromeda-postcss-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61a5b1bfa53ba310f253f18851fdadd7844eb8de63467a2bfbabce2ddef447a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-114604

Malicious code in deimos-sass-loader-quark-dotenv npm...

EUVD-2025-111508

Malicious code in lyra-eleventy-phenomic-css-loader npm...

Malicious code in perseus-less-loader-uninstall-enceladus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d0acd2d52c31594304a5cb4d7f1f978a7ccb708ecc08f763b3b072edd8a37b2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-116554

Malicious code in aquarius-sass-loader-morgan-unuk npm...

Malicious code in postcss-loader-commitizen-foundation-xenos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3544c8a28f043aa9e67e4ced4509db2908ad6675975cdeb4198f6d034572831a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-123528

Malicious code in postcss-loader-elara-izar-pino-pretty npm...

EUVD-2025-122447

Malicious code in rocket-orbit-grus-sass-loader npm...

EUVD-2025-122243

Malicious code in sass-loader-nightwatch-await-hermes npm...

Malicious code in jekyll-transport-fusion-css-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90acc8ffa85bac80ebe5f7d7f7ff730194b5d208154fe0f059cf44abad400c98 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145461 Malicious code in nightwatch-css-loader-charon-gemini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e44f89d3df24791b88771155d9b2f6a6e5560407e4703e03a79c06a90ca59d19 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-114428

Malicious code in docusaurus-websockets-sass-loader-upgrade npm...

EUVD-2025-122245

Malicious code in sass-loader-mui-library-optimize-css-assets-webpack-plugin npm...

EUVD-2025-123913

Malicious code in pavo-registry-sass-loader-barnard npm...

Unbreakable Enterprise kernel security update

5.4.17-2136.349.3.1 - i40e: add validation for ringlen param Lukasz Czapnik Orabug: 38604171 CVE-2025-39973 - i40e: increase max descriptors for XL710 Justin Bronder Orabug: 38604171 CVE-2025-39973 5.4.17-2136.349.3 - Revert 'net/mlx5e: Update and set Xon/Xoff upon MTU set' Jakub Kicinski Orabug:...

GHSA-F83H-GHPP-7WCC Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc

🚀 Overview This report demonstrates a real-world privilege escalation vulnerability in pdfminer.six due to unsafe usage of Python's pickle module for CMap file loading. It shows how a low-privileged user can gain root access or escalate to any service account by exploiting insecure deserializatio...

Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc

🚀 Overview This report demonstrates a real-world privilege escalation vulnerability in pdfminer.six due to unsafe usage of Python's pickle module for CMap file loading. It shows how a low-privileged user can gain root access or escalate to any service account by exploiting insecure deserializatio...