Malicious code in objective-orange-butterfly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4c67f102df9fb75fab419ceb98245d11d1c0b6307b7ef3b6ec6abcf89f0f590 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-70987 Malicious code in surprised-gray-chimpanzee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef79fe8cfe0b4a72c5015d70be6b83e73d78e0fe38ed0962e90ef1072efa796d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-66559 Malicious code in @bipyruss/ciphersage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe2a5b3466a9a0966cbec8fea3a3c30a21f29edeb9b0c51f8e727affe28a1106 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-71258 Malicious code in underlying-fuchsia-wren (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78e45aa85705cce9cee067af2e2d2409adf9ac411ae4009726914563642be7a1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in yodelling-blue-urial (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08ffc74789697507b76fd56549cc47cc4f40a37b4ee9e84039091c8efae233b6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-68831 Malicious code in inappropriate-lavender-reptile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c53a5ad5ae8eec3da4914b97f9b639f8d09ac54c71020e2d6854bae505c7ed2a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-66067 Malicious code in wati-liwet80-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e3cb8d4395751553280ee9b45b80beac69a4add672e965ae20b1cd0017a0f81 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-63673 Malicious code in joko-gado-gado81-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15fd8f8f0ea216359778c9cb9a658da767a42aeb0a138d2ad6705a9864f98e6e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in arif-nasisayur90-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bb051081e2a76a111786938b1ebf710e0e97472c41edfc64cff2c2b30838f1e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Automated Hardware Trojan Insertion in Industrial-Scale Designs

Industrial Systems-on-Chips SoCs often comprise hundreds of thousands to millions of nets and millions to tens of millions of connectivity edges, making empirical evaluation of hardware-Trojan HT detectors on realistic designs both necessary and difficult. Public benchmarks remain significantly...

CVE-2025-64502

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. The MongoDB explain method provides detailed information about query execution plans, including index usage, collection scanning behavior, and performance metrics. Prior to version 8.5.0-alpha....

Malicious code in possible_deer_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67ccb64dda21b9d417171d03a0a5ef0ca5ec8ff791dfe74d6124d7a28689fe9c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in far_bovid_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de9eea047684652b79c3bc2328fd29ff02d33de8a5fffd60384e4542a1225d7d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-58220 Malicious code in putra-mendoan68-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc224d2aabd3d6e5f3d471e20981e728b1820dcce5637273dd7e7d90da0d6414 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-54768 Malicious code in rudi-peyek74-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 439c2f23feae654adcc8fe476b78b5837692915d7996a2ffa6a131415aa681bc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-51741 Malicious code in erwin-brengkes34-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd8702e8e36015d70b6400cbf55e0b3f444bca7a07dce7fa0d47258247bac632 The package erwin-brengkes34-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

CVE-2025-64179 lakeFS: Unauthenticated access to API usage metrics

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. In versions 1.69.0 and below, missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may...

EUVD-2025-37514

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. In versions 1.69.0 and below, missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may...

From Model to Breach: Towards Actionable LLM-Generated Vulnerabilities Reporting

As the role of Large Language Models LLM-based coding assistants in software development becomes more critical, so does the role of the bugs they generate in the overall cybersecurity landscape. While a number of LLM code security benchmarks have been proposed alongside approaches to improve the...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990540)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990540 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv4: prevent potential spectre v1 gadget in ipmetricsconvert if !type continue; if type RTAXMAX...