MAL-2025-172050 Malicious code in apas-lepod-manusiad (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4548dccbc8384735c84ba26b3025b86993449d291bf1406a7af1eaf6153ce0c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-171063 Malicious code in constellationdreamer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3a0921782b1620a883f1b56a69736fb66d637cf9de5f64a4eb355a86a884f88 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pilka-lni-pialima (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0698d6edca4ef8b928543ea6fb777baea905161b5d48396fd8ec252e2c45dabf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teagood-nalikami133 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c091513f4b957819ad9314948eab6531e2f0316d4a21a5d64d84241561d0ae46 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in google-cloud-iam-credentials (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e75faf49c379401db38883bfb490edbc74161e0d52d38f6aac38f6166645133a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

thunderbird: firefox: An OBJECT tag type attribute overrode browser behavior on web resources without a content-type

A flaw was found in Thunderbird and Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a content-type. This...

Drupal core - Moderately critical - Denial of Service - SA-CORE-2025-005

Drupal Core has a rarely used feature, provided by an underlying library, which allows certain attributes of incoming HTTP requests to be overridden. This functionality can be abused in a way that may cause Drupal to cache response data that it should not. This can lead to legitimate requests...

MAL-2025-137590 Malicious code in unemployed_flamingo_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fdbebed29ac5729038fb197c23d3892c63f773f187dc3f45f4cd00fef4d8a75 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wawan-nasisayur29-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 298e12a3f540128abd1b43673aeca889926b9917c160643900175f199f5e5292 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fajar-rangginang42-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d235fe2409baca0f8b808e3dd542f2078b31de817a02a1c48f9225dde8d5fba This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-124571 Malicious code in yuni-mieayam26-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4e97d799e161a8be547668f9efc45423b40601ab28119fa9efed47421136545 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

kernel: firmware: cs_dsp: Fix OOB memory read access in KUnit test (ctl cache)

In the Linux kernel, the following vulnerability has been resolved: firmware: csdsp: Fix OOB memory read access in KUnit test ctl cache KASAN reported out of bounds access - csdspctlcacheinitmultipleoffsets. The code uses mockcoefftemplate.lengthbytes 4 bytes for register value allocations. But...

MAL-2025-107878 Malicious code in remaining_dragon-silentdev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11bd0bc15941556638c5cfcaabfc7572165c49042eabe1eab034a349c7ce0089 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in civic_cat_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca18aedb464ddefdc6eb9ddd13cb45a5fb84195b9f5c9bc2d2176b139b1f0ec3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-57149 Malicious code in kiki-mendut70-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f653b9dbed47433e8223ff39d35480a439daf38bdd3e60f294ea73ee5c621f15 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-56893 Malicious code in irma-nasicampur53-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc6cc1943eff92743de1378f3c4a71b1c7e8c5a7505ca33342bfe59f8a7f7ed8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in siska-gembus49-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5f6ad97907b6c0558c865bc8b6cbbbd79d7f9b201425043ee2d398ad4a596f3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in qori-empal47-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bad20da48e39bb4f2f84b27b85ff888502158ccd83a8be7ec33a56fc8affc104 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bayu-kue21-apidev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ade5353b6669b7c0ea30f259a409f11884cd7fc5deb8a79b3f2f1f3d3a6563cb The package bayu-kue21-apidev was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

thunderbird: firefox: An OBJECT tag type attribute overrode browser behavior on web resources without a content-type

A flaw was found in Thunderbird and Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a content-type. This...