CVE-2026-40090 Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write

Zarf is an Airgap Native Packager Manager for Kubernetes. Versions 0.23.0 through 0.74.1 contain an arbitrary file write vulnerability in the zarf package inspect sbom and zarf package inspect documentation subcommands. These subcommands output file paths are constructed by joining a...

Directory Traversal

Overview @pnpm/package-bins is a that returns bins of a package. Affected versions of this package are vulnerable to Directory Traversal via the getBinsFromPackageManifest function. An attacker can modify file permissions outside the intended directory by supplying a crafted value in the...

Malicious code in resolvers-kinetic-eventhoriz-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10aa06e998c3d788fa72d46ef212a5ae000339d3d9b287dfddbbd99d288cc440 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in protractor-biotechnology-hercules-relay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 163a7ced86ddfa55ba2c67f667dc44c1bac1fdaddd5dc437b94c8877eeed6e8b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in babel-isostasy-fork-buffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4029f1afea75ea29252cb472964df460c97f3532605fa62b8d6b41fbc1c02350 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nu-grid-import-chi-assert (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 200f766004c24652d0932dc06aa4b8466f33c8f680b403bc5562d701a3973417 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in greatfilter-lithosphere-isostasy-rocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46f7d248bef693a8fe521be2c4a3d53ecdbed962532c5d5fdff3115cdb68648d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in easy-kernel-deserialize-public-await (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1c7f9693c4ee4fd27e0d30c8a5e7c70561a199ab73f1468b17ef1596d9c03dd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in stub-emulate-decompress-view-sandbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3014404892613825d603f59e7f5acebc98b397d1e96068233852a6fa05f78311 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in release-it-materialize-quasarjet-perturbation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 035050b3353edebeccd5d0176758cd056d40864422a03aac5416c61490399142 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in update-meteor-jupiter-kaus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a6356d84e2bdfa2e9952503f7bfa22d9940fbccd3d5d7e5296766420d0ce81b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in stack-bundle-public-air-user (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36a6dad623ae43208f3d2ce6d58b9a6877f82f8d1b29ce106c6cf596c71f8fb7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jsonp-lacerta-eris-octans (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4338b9067de467c48ebcb22a68da6ba8445e72cde9039197e552af0dcfce6e4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lint-staged-lint-staged-auth-terser-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03253bd76fedc24d55504b970d032ee47ad508a341ba8a5531490b0b9ae15ee3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lint-staged-superagent-eridanus-bionics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 066dc6b85c08093514728ad74577e54a20edffbcf7d838638c2e8ccbdc1dfd28 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186102 Malicious code in chalk-resonance-triton-mineralogy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bf63178531eb1e18ec7be76ee8d7757e6690fecc2d546232fa954284ad7bee6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-190150 Malicious code in view-omicron-unix-compress-authorize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d86eb2e159a609113cfc2efc8435ff741a9e4a3d864ae507fe6a729dd0058b3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186076 Malicious code in chai-gatsby-coronalmassejection-nuxtjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1965265a6fd3542b543b488677095044706c61ca1aff9178346019531c500d8b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188824 Malicious code in private-cluster-draco-mysql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d55b2c6488f879be03519756749da7f5fc5c54c6733164935e0c5d7f8304675a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189208 Malicious code in resonance-middleware-octans-graviton (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9970ca8ef6e7f17379376bad34acd43e416abc3403acca977d152258ab4811af This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...