Astra Linux – Vulnerability in Node.js

The generateKeys API function returned by crypto.createDiffieHellman only generates missing or outdated keys. In other words, it only generates a private key if none has been set yet. However, this function is also needed to compute the corresponding public key after calling setPrivateKey...

AZL-103380 CVE-2026-25832 affecting package nodejs 24.20.0-1

In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group...

AlmaLinux 8 : nodejs:22 (ALSA-2026:54530)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:54530 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash via...

AlmaLinux 9 : nodejs:22 (ALSA-2026:55601)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55601 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash via...

AlmaLinux 8 : nodejs:24 (ALSA-2026:54371)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:54371 advisory. sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data CVE-2026-11822 sqlite: SQLite: Arbitrary code execution and crash via...

Malicious code in jdevice-nodejs-sdk (npm)

The package jdevice-nodejs-sdk was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in javascript-nodejs-lint-staged-build (npm)

Source: amazon-inspector 950a7016236c5fc899c18a2afba5edad822d00009aafafb79a9a52e55dd8a106 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in izar-magellan-readable-nodejs (npm)

The package izar-magellan-readable-nodejs was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in iota-umbra-upgrade-nodejs (npm)

Source: amazon-inspector b2c04ac07f526f3fcfc93f56356dc15234e960923abca2cb92e88e86e933e315 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in integrationkit-nodejs (npm)

The package integrationkit-nodejs was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in init-optimize-css-assets-webpack-plugin-nodejs-grus (npm)

Source: amazon-inspector 70dc2863be0d9933feb9f50a9c64d52707a31a7128d733acb26dcaf70e489128 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ini-nodejs-speleology-filament (npm)

The package ini-nodejs-speleology-filament was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in hydra-eslint-config-nodejs-triton (npm)

Source: amazon-inspector 22bd03acfb41ff6f5766ec626da59dcbf0d5d6d39c929f23e44e554bf3d2eac2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hugo-prompts-install-nodejs (npm)

Source: amazon-inspector e323f5bb8d985d0dc02ff975746ce4d5f88126d9da820e1d55eb820e3a144653 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hugo-eslint-config-rimraf-nodejs (npm)

Source: amazon-inspector 8bfccf30b1a5f7c4f96740bbe3fbcbab70e17acf331b86b4d3d94a861e7f4d3f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hermes-celeste-react-bootstrap-nodejs (npm)

The package hermes-celeste-react-bootstrap-nodejs was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in hereaccount-nodejs (npm)

The package hereaccount-nodejs was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in health-check-nodejs (npm)

Source: ossf-package-analysis ef9d93b4469df4d458d4c4a226b45fa7baf7760a84cd3d8b5fc84fb990e0e6ba The OpenSSF Package Analysis project identified 'health-check-nodejs' @ 3.16.1 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious...

Malicious code in halley-cosmiconfig-nodejs-ganymede (npm)

Source: amazon-inspector 06dade96fb0e2431b0716ce1e1641fac7e05a2a2cad951c5e33772fc3cec2128 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in gulp-nodejs-bellatrix-process (npm)

Source: amazon-inspector a51c5af9497d648c837690d26c1883cd6827d6a576e08da0c2774ab1f1c3bf66 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...