MAL-2025-191355 Malicious code in @voiceflow/metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db3392082319ffd4259935cf7d4eae448c38fdea2e5d9a1749c26a991fd78dc1 The package @voiceflow/metrics was found to contain malicious code. Source: ghsa-malware...

PT-2025-48095

Name of the Vulnerable Software and Affected Versions VictoriaMetrics versions 1.0.0 through 1.110.22 VictoriaMetrics versions 1.111.0 through 1.122.7 VictoriaMetrics versions 1.123.0 through 1.129.0 Description The software is susceptible to Denial of Service DoS attacks. The snappy decoder did...

VictoriaMetrics 安全漏洞

VictoriaMetrics is a time series database open-sourced by VictoriaMetrics. A security vulnerability exists in VictoriaMetrics versions 1.0.0 through 1.110.23 prior, 1.111.0 through 1.122.8 prior, and 1.123.0 through 1.129.1 prior, which stems from a request size limit being ignored by the snappy...

OpenTelemetry with Spring Boot

This is a new blog post in the Road to GA series, and this time we're taking a look at OpenTelemetry with Spring Boot. Introduction In modern cloud native architectures, observability is no longer optional; it is a fundamental requirement. You want to understand what your application is doing via...

A Unified Compositional View of Attack Tree Metrics

Attack trees ATs are popular graphical models for reasoning about the security of complex systems, allowing for the quantification of risk through so-called AT metrics. A large variety of different such AT metrics have been proposed, and despite their wide-spread practical use, no systematic...

GO-2025-4090 lakeFS affected by unauthenticated access to API usage metrics in github.com/treeverse/lakefs

lakeFS affected by unauthenticated access to API usage metrics in github.com/treeverse/lakefs...

An Evaluation Framework for Network IDS/IPS Datasets: Leveraging MITRE ATT&CK and Industry Relevance Metrics

The performance of Machine Learning ML and Deep Learning DL-based Intrusion Detection and Prevention Systems IDS/IPS is critically dependent on the relevance and quality of the datasets used for training and evaluation. However, current AI model evaluation practices for developing IDS/IPS focus...

Malicious code in grus-superposition-pegasus-antd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dad58e646a9599b1bc74e3e52f19631059b4d22a2879e23b3516e4ff029e303d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in deneb-juno-telesto-shelljs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33bae7e16402e2f9c25bdb4393c7c91edbd242e3766f9626e46b527e7e400a2f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188690 Malicious code in photon-transhumanism-cosmicray-neptune (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88b6074683fa16520e5fd63fcb6e27cbd091b49c4588f9809e04d8af25c35823 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in firebase-selenology-blitz-eleventy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ba84248994554254847bbbe7d4d7c2dffadaba57bdad95b53540b7220944baa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sagitta-frontend-eslint-config-cors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c2500c73f9e15b142f13f572a687f151b1f6a8e3eb54fb96cbd58ce242f02f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Parse Server allows public `explain` queries which may expose sensitive database performance information and schema details

Impact The MongoDB explain method provides detailed information about query execution plans, including index usage, collection scanning behavior, and performance metrics. Parse Server permits any client to execute explain queries without requiring the master key. This exposes: - Database schema...

GHSA-7CX5-254X-CGRQ Parse Server allows public `explain` queries which may expose sensitive database performance information and schema details

Impact The MongoDB explain method provides detailed information about query execution plans, including index usage, collection scanning behavior, and performance metrics. Parse Server permits any client to execute explain queries without requiring the master key. This exposes: - Database schema...

Malicious code in modiov-kilan-avumanaiab (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db629712d0c323f05362f626b330c7e855c18ced48ad453b34063bb77aeab07a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-oig-tmoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d4a649186286dab822f4ad87dd6845317574606d6d66a4406e72363dcf08f6e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-licki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f25ff3421cf3a2c29bbbe4e178a02aeb852bf2f6f952278fc77d4e13fa0a20a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in icha-72 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d216b393b30896cfced549c6d422ccdee83bbabaa52b184c68c38206df12c86 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ma-rasaaya-nurses (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb38a83e5a36ceb61bf8cebbdb056ebf8e0d4000d123a3c28b6d0c6331ad6e9a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in messi-ata-fuf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f9180d65291e2127f34b75e4df2fdbc020b802c0b1f9eafe36cf126e9e65a30 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...