134380 matches found
Malicious code in high_smelt_z3n (npm)
Source: amazon-inspector 3e19a2ef2b4517bc4740697e327128915b741390c100be9da25b0604034d7647 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in hendra-nasiuduk89-breki (npm)
Source: amazon-inspector a6426eaed4c8972dd6b1c95ad7274e7beffb50dfeaec7559796d5e7deb234ba1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in hendra-klipo16-miaww (npm)
Source: amazon-inspector d6c0ee401db3abbd54b237c350dff18aaa01524b50bdaafa0f54e9ea2f85aa2c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in hariyono-poke17 (npm)
Source: amazon-inspector c4b30697c67d6064c1f2f994ff9bfcb044b69ed347a905e9e2ad56260373883d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in hanafi-ketoprak33-riris (npm)
Source: amazon-inspector 479dad009564426fb650653b0ee16bb58bc890617d048fbe80f41bc99da2cda7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in hanafi-gorengan46-breki (npm)
Source: amazon-inspector 111f16141cd1f923a6fc46e9ea4c3e3f97359415a9630528a28b38aadfa82a11 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in hadi-oncom89-ruro (npm)
Source: amazon-inspector 9358a26a4047d8aadea85f03219c3b5172be577c40040df8114ade3d934b3c60 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in hadi-lutis18-riris (npm)
Source: amazon-inspector 43ecfe7b3afd481a6d282bd0a13fa799171aafc509dec512d1fb544e496c3037 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in gociay-uinga-uugfu (npm)
Source: amazon-inspector 9223d80a741f496e4880dd3344fb52015a457bc3498603fd848a58203a89dfd7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in gita-toge4-miaww (npm)
Source: amazon-inspector 46ac5f11ad8c87be2d80085ea310f598b6eced5de402ece9949c025df022e90c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in gita-teh95-breki (npm)
Source: amazon-inspector 9b1f8bcbb68d6f22e4d404d11f1f46da53c1c1e4f1be524794d79926ce51bd59 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
PT-2026-90838
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code. Attackers can supply proto keys in custom messages to replace the returned object's prototype, breaking downstream code relying on...
CVE-2026-90771: Improperly Controlled Modification of Object Prototype Attributes
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code. Attackers can supply proto keys in custom messages to replace the returned object's prototype, breaking downstream code relying on...
yayson: Prototype pollution in Store/LegacyStore deserialization
Summary Store/LegacyStore key internal lookup tables by the type, id, and relationship names from a JSON:API document. Because these were plain objects, a document with type: "proto" writes onto Object.prototype, polluting every object in the process. Severity Suggested CVSS v3.1...
NPM: yayson: Prototype pollution in Store/LegacyStore deserialization
NPM: yayson: Prototype pollution in Store/LegacyStore deserialization vulnerability discovered by ? in WordPress Npm yayson versions = 4.2.0...
GHSA-325J-MG25-8Q58 yayson: Prototype pollution in Store/LegacyStore deserialization
Summary Store/LegacyStore key internal lookup tables by the type, id, and relationship names from a JSON:API document. Because these were plain objects, a document with type: "proto" writes onto Object.prototype, polluting every object in the process. Severity Suggested CVSS v3.1...
Security Bulletin: IBM Cloud Pak for Data is vulnerable to prototype pollution due to flatted ( CVE-2026-33228 )
Summary Potential vulnerabilities in flatted package CVE-2026-33228 has been identified that may affect IBM Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-33228 DESCRIPTION: flatted is a circular JSON parser. Prior to version 3.4.2, the parse function in flatted can use...
Security Bulletin: Platform Navigator in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in browserslist
Summary Platform Navigator in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in browserslist. CVE-2026-73088, CVE-2026-73089 The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-73088 DESCRIPTION: Browserslist is a configuration tool for sharing...
