CVE-2026-40090 Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write

Zarf is an Airgap Native Packager Manager for Kubernetes. Versions 0.23.0 through 0.74.1 contain an arbitrary file write vulnerability in the zarf package inspect sbom and zarf package inspect documentation subcommands. These subcommands output file paths are constructed by joining a...

Directory Traversal

Overview @pnpm/package-bins is a that returns bins of a package. Affected versions of this package are vulnerable to Directory Traversal via the getBinsFromPackageManifest function. An attacker can modify file permissions outside the intended directory by supplying a crafted value in the...

Malicious code in babel-isostasy-fork-buffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4029f1afea75ea29252cb472964df460c97f3532605fa62b8d6b41fbc1c02350 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in greatfilter-lithosphere-isostasy-rocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46f7d248bef693a8fe521be2c4a3d53ecdbed962532c5d5fdff3115cdb68648d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jsonp-lacerta-eris-octans (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4338b9067de467c48ebcb22a68da6ba8445e72cde9039197e552af0dcfce6e4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in protractor-biotechnology-hercules-relay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 163a7ced86ddfa55ba2c67f667dc44c1bac1fdaddd5dc437b94c8877eeed6e8b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in release-it-materialize-quasarjet-perturbation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 035050b3353edebeccd5d0176758cd056d40864422a03aac5416c61490399142 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in resolvers-kinetic-eventhoriz-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10aa06e998c3d788fa72d46ef212a5ae000339d3d9b287dfddbbd99d288cc440 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in stack-bundle-public-air-user (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36a6dad623ae43208f3d2ce6d58b9a6877f82f8d1b29ce106c6cf596c71f8fb7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in stub-emulate-decompress-view-sandbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3014404892613825d603f59e7f5acebc98b397d1e96068233852a6fa05f78311 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in terser-webpack-plugin-rollup-plugin-cybernetics-lacerta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6b7843b7f7891a049059218853ee6c6a14322926fe06a83bd6cb691a16048b9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in troposphere-comet-changelog-html-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b74ff548784ce3a86f53316b5de4200f29c883e33f658fd92f1e8e6322c765f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in update-meteor-jupiter-kaus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a6356d84e2bdfa2e9952503f7bfa22d9940fbccd3d5d7e5296766420d0ce81b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xenos-xanthus-celeste-react-bootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e905ee031b2c4ef7912618f1d64a99f35e6da479055f1504c5b29a0adaac500 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in subduction-phylogenetics-tachyon-tethys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0d23e85fad2795bccb4695d01f55d114917b907a7cc918c35106dd514064a39 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in centaurus-superagent-spinner-leda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91d406ed50d97258b1c60ee835ae0350d359b3f8576bc1a5411d4da722d37cb4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187673 Malicious code in kaus-antares-update-neptune (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector faae86e3561dc9f38756cb2bfff0accf7d215afbb11969a94ba45bf705675a63 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185906 Malicious code in brane-halley-solarnebula-stratosphere (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9dbe993ab0d2060aad81f817e0d23ae578985071a1a988c2fa1c1cd10c224534 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187196 Malicious code in google-radiant-weywot-rocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90c66e0686c4618a725de20e95e6ce1715c68327b6ccc280c359a1139312e4a2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186311 Malicious code in coronalmassejection-asthenosphere-astrobiology-cassini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9cb81f3d331d2861ecc6df39b2c8a84b53696cd5c489d6e3157782d4426db0c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...