PT-2026-86866

In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues...

NLTK java() function RCE

The vulnerability of the java function in the nltk/internals.py file of the NLTK library, a software package for symbolic and statistical processing of natural language, is related to the implementation or modification of arguments. Exploiting this vulnerability could allow an attacker to gain...

Malicious code in eka-empal81-kyuki (npm)

Source: amazon-inspector 03550d88da237c64ebaddf1ce9ac24f632108f1eda5a68e193eff0c4388e573c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eka-esdoger71-pore (npm)

Source: amazon-inspector bff8f202ef46bc6b780fc980dc8e35057e6197f3ff753bbe3622d421cf251c80 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eka-esdoger53-breki (npm)

Source: amazon-inspector e83c4e4a678bbe1d679a73b95712ddfbc1d1838f429b085f8089f42561c9adc6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eka-empal64-breki (npm)

Source: amazon-inspector 28747e68a4930908b9444b828518a2e8729690b635a19e9a13825f47c65d403a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eka-buburayam35-sluey (npm)

Source: amazon-inspector 53fa6b5506fb133f0c224da91595a663d94894ea3d716af86993fecd9493b4d1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eka-botok35-miaww (npm)

Source: amazon-inspector 61b382c17673ae46fe0682cfbe4d1488662df5f0f48d6fbea908468a41ac1eb9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eka-bubursumsum84-sumpek (npm)

Source: amazon-inspector 15f9de3c135e241dfd0c2183bb782dfd805978024e082cfe2300ad0182e68621 The package eka-bubursumsum84-sumpek was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded npm with over 15,000 spam packages in 2024. These...

Malicious code in eka-bakwan35-riris (npm)

Source: amazon-inspector 48e043fea9a291eb74abd94cb1d00ab948e1f3d7b819fdcd44f5d55742fce431 The package eka-bakwan35-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded npm with over 15,000 spam packages in 2024. These package...

Malicious code in eka-brongkos63-sluey (npm)

Source: amazon-inspector 48b061688768303e7260496080a3ff3c75d448ea6b4644350ea1dc10330ec925 The package eka-brongkos63-sluey was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded npm with over 15,000 spam packages in 2024. These...

Malicious code in eka-buburayam76-ruro (npm)

Source: amazon-inspector 4813c3b8f8b4f71766b6e3a9255b83df5624a70b3da1d6e9c6baf821f373dd0e The package eka-buburayam76-ruro was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded npm with over 15,000 spam packages in 2024. These...

Malicious code in eka-brengkes16-sluey (npm)

Source: amazon-inspector 70b0287c686075ae657711a7824879ddeff354cbcc0f393e25afa8fdf2bfd9c2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eka-brengkes56-riris (npm)

Source: amazon-inspector 0e22c5eb603070644f1fb580138141f258f7ba9ccd68950abd51845c3912989a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eka-brengkes59-sluey (npm)

Source: amazon-inspector 0a5486be8bbe4e4b7a1060c7dd8b36c5dfe102b24b907990303d16a2815494ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eka-bakso19-miaww (npm)

Source: amazon-inspector f2dd1db4e43063490ad7a40ad705bfe1b5f9bfbeadbe17f7152faadf99e00bfe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eka-asinan60-sukiwir (npm)

Source: amazon-inspector 9041472cfac43dbe03ae85bd7f201506f5c866da9d92ace8406e7fffb8afb29f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eigenstate-gravitationalwave-config-ora (npm)

Source: amazon-inspector e1ac45b72547ad9810a75d1263cb7b9a765a2eb4ffc477983e5b99f4890b2e1e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in egret_moccasin-14 (npm)

Source: amazon-inspector e2705cfdd4c2ea9c7d5fe30336e2644ba6169d61ebb7f88d9d41a4eed5a7e233 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in efficient-brown-quail (npm)

Source: amazon-inspector f08561742a4b64dc0950f7888c6714306acc1fd50e29e1b8e2140835cd7bbc75 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...