Malicious code in late-white-whale (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90eb10c7af4c8cef448526af282d5089bb64071b81a7fe476c4f005710c560fb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in potential-salmon-snake (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b710994e484177da233d848af8e1549c3b277f9d7efcf01c868add0e2abb1d8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138989 Malicious code in running-chocolate-lynx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffb77eade9c851555770d34c459c181ac2b42fd29241f721bf91dcd1693e23d1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mammoth-brown-mink (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cfac41640fd80e5a53b1801bc8d9c150c5fd613bbb318bc5064c0781c6477db This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in unknown-white-cricket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb81dd3f6a1c64968e6d832222379c22d81a0d68cdbb8d92aee62cd51375d7b0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138837 Malicious code in liloyst (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1fc931892e1340a03042f91e1ca48d04171168fa64ec768aed1aa592f2efd6d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in immense-olive-octopus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02656cceb4e7ac01cccd5f7f32289d5e16a49c1b8bc908aaa45b22a06f90fc0a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in orthodox-blue-mastodon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ecdd7fccdbeb5a8a860588776e90de4bc8e90a50771100a4fd66e0ab1999495d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138717 Malicious code in fascinating-coral-marlin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c8f65e9fdaf8502289c4e3097788b192701db6d4ed046852d818449c6ab10a4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139057 Malicious code in surrounding-olive-caribou (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51b64e4a56a725b2726b1b2ca6dbf6ccc1754bd55922937806bafbfc7344cb02 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

libtiff: Libtiff Write-What-Where

A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controll...

kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy

In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfsmdtdestroy In allocinode, inodeinitalways could return -ENOMEM if securityinodealloc fails, which causes inode-iprivate uninitialized. Then nilfsismetadatafileinode returns true and nilfsfreeinode...

CVE-2025-42919

Due to an Information Disclosure vulnerability in SAP NetWeaver Application Server Java, internal metadata files could be accessed via manipulated URLs. An unauthenticated attacker could exploit this vulnerability by inserting arbitrary path components in the request, allowing unauthorized access...

EulerOS 2.0 SP12 : python3 (EulerOS-SA-2025-2370)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some fil...

PT-2025-46693

Name of the Vulnerable Software and Affected Versions IBM OpenPages versions 9.0 through 9.1 Description IBM OpenPages versions 9.0 and 9.1 have a security issue that could lead to the disclosure of sensitive information. This is due to insufficient security measures on certain REST API endpoints...

EulerOS 2.0 SP12 : python3 (EulerOS-SA-2025-2339)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some fil...

Malicious code in gita-lupis30-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e87bb27af23074a493d553f2b667cb8a164a088ee50c32ba8a8f8c3df0911aa0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hadi-sate60-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b223a79028294d4b43209ccef30b45eceffcff7b4aa6ef2f9362ca1b36b231ab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nurul-sate73-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e66e5cfb351aa62051b110089f1f3bbf3f9ca667dc60208af311b45b57376503 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in erick-ongol-ongol19-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87ceb83df9603b0e1e7662e4be5714c0a85d7027d20c001e19c93e86c67413c4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...