Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in Next.js (CVE-2026-44572, CVE-2026-44573)

Summary Multiple vulnerabilities including SSRF and header manipulation in Next.js CVE-2026-44572, CVE-2026-44573 used by IBM InfoSphere Optim Archive Viewer have been addressed by upgrading the component to version 15.5.21. Vulnerability Details CVEID:CVE-2026-44572 DESCRIPTION: Next.js is a Rea...

Malicious code in leda-nodejs-nextjs-sirius (npm)

Source: amazon-inspector 8488e7f3eb1b0a423523519eca85887ecd6c04e408dbec4c05e2e936659200fd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious Package

Overview leda-nodejs-nextjs-sirius is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in kronos-antd-dorado-nextjs (npm)

Source: amazon-inspector 0b8e09b76536f45aa4ef31616dc333b425d9f61069db20dbe9ec7a8b487ad6fe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in kastra-nextjs-tethys-acamar (npm)

Source: amazon-inspector 5237449ddd14cad0c7a757cf5ecff71002c9c6726139843650a1a07f68385093 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in jest-nextjs-wormhole-hadron (npm)

The package jest-nextjs-wormhole-hadron was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in io-nextjs-loopback-blitz (npm)

The package io-nextjs-loopback-blitz was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in inquirer-nextjs-galaxy-hyperion (npm)

Source: amazon-inspector 27bcdd082ce996def33fdd212572b9582cbc25f6717782a182c5688ad39d01c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in indus-triton-polaris-nextjs (npm)

Source: amazon-inspector ce16fae40cad6ac6618e19cfa3d4f555f05adf35508e0718734b0f1a138f2efe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in impulse-mdx-quantum-nextjs (npm)

Source: amazon-inspector 5c36caf23a8d04a63bccd9e6f7ffac308c2ee9c62c18e2f3f6e549f580d38621 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hyperion-markdown-process-nextjs (npm)

Source: amazon-inspector 536192c36618e27ff8830d058e31380e4431d9840dd8c3106a5eb2f8bc58953b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in husky-helios-wezen-nextjs (npm)

Source: amazon-inspector 17649c319fbcd9560753b90dabe7181f60522771c2b424dd6054ff810384f2b4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hermes-testcafe-toml-nextjs (npm)

Source: amazon-inspector a440cd57546a04a8a84419e52d295a653a4daa9bc232f5fb240bf5b9cf716493 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hercules-nextjs-zephyr-install (npm)

Source: amazon-inspector d8344c28a41b99d856235ce4061e3fe1cef579c6bc379248ce3e9a5a886efe76 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in helios-uglify-js-nextjs-kaus (npm)

Source: amazon-inspector 9c6948ab4c43a4459026e7fab984c2823c9512f7a3204cc4437e5d1a651020ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in got-prettier-stylelint-server-nextjs (npm)

Source: amazon-inspector 8d1e434b1aebd213e3a779b99e36366e7eebfbad07d55fc7687682a5c644709f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in global-tethys-nextjs-iota (npm)

Source: amazon-inspector a5f8b46fa41816c24f285bf776951b6df137bb968ad99be9a19ab9abd22c3841 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in global-lacerta-sagitta-nextjs (npm)

Source: amazon-inspector 3aab090a06890abad34f96c9d0c014ede763e63fe2ccc634f3da5a8b7fa2a1af This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in exec-less-commitizen-nextjs (npm)

Source: amazon-inspector c99abd01217e56aebbfb133b6b43794511bc65b3e048a0bb58821ba2d7898bb4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eris-hermes-nextjs-spinner (npm)

Source: amazon-inspector 8d78ef202fede5425a153b911768f8232a8ba154b1acff3998b72b75a604f20c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...