The price of ChatGPT’s erotic chat? $20/month and your identity

To talk dirty to ChatGPT, you may soon have to show it your driver’s license. OpenAI announced last month that ChatGPT will soon offer erotica—but only for verified adults. That sounds like a clever guardrail until you realize what “verified” might mean: uploading government identification to a...

DualTAP: A Dual-Task Adversarial Protector for Mobile MLLM Agents

The reliance of mobile GUI agents on Multimodal Large Language Models MLLMs introduces a severe privacy vulnerability: screenshots containing Personally Identifiable Information PII are often sent to untrusted, third-party routers. These routers can exploit their own MLLMs to mine this data,...

New Data Security Requirements and the Proceduralization of Mass Surveillance Law after the European Data Retention Case

This paper discusses the regulation of mass metadata surveillance in Europe through the lens of the landmark judgment in which the Court of Justice of the European Union struck down the Data Retention Directive. The controversial directive obliged telecom and Internet access providers in Europe t...

PT-2025-47193

Name of the Vulnerable Software and Affected Versions Freebox v5 HD version 1.7.20 Freebox v5 Crystal version 1.7.20 Freebox v6 Révolution r1–r3 versions 4.7.x Freebox Mini 4K versions 4.7.x Freebox One versions 4.7.x Description Freebox devices expose subscribers' IMSI identifiers in plaintext...

Your passport, now on your iPhone. Helpful or risky?

Apple has launched Digital ID, a way for users in the US to create and present a government-issued ID in Apple Wallet using their passport information. For now, it works only for identity verification at Transportation Security Administration TSA checkpoints in more than 250 airports. Apple says...

Automated Side-Channel Analysis of Cryptographic Protocol Implementations

We extract the first formal model of WhatsApp from its implementation by combining binary-level analysis via CryptoBap with reverse engineering via Ghidra to handle this large closed-source application. Using this model, we prove forward secrecy, identify a known clone-attack against...

Malicious code in entanglement-greatfilter-void-callback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5c938a40aa714464f758cf9b7ffb6b9ac75e1e0bfdfb7fa0e1b292f499d3135 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in octans-cybernetics-carpo-norma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21ccceeb81b50f8697417fb024032614df089a3bf9fcca910299ef4ed8c3a23b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186803 Malicious code in eridanus-antimatter-figures-dotenv-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc9f078e333a05d5703ffb66d84694f1b93317ddb74c0ff6cd1be5c855ec5899 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kastra-oberon-spectroscopy-mocha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2e7279e1ca549eb0a3e63cb167e9feb16a51f1dedbbf158bf38ddbc2b169e23 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

How Worrying Are Privacy Attacks against Machine Learning?

In several jurisdictions, the regulatory framework on the release and sharing of personal data is being extended to machine learning ML. The implicit assumption is that disclosing a trained ML model entails a privacy risk for any personal data used in training comparable to directly releasing tho...

Malicious code in sonic-kulig-tgviave (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f465988c7741c5cdeb8cc7808b2ba7d42b3869c8b1a1c1ab0cfe0a034fc7cda This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-182100 Malicious code in gocay-guga-visi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a1f20bd9cb0bc58e595f39c6399bedb6b92035d94ffa79e7a77d6889d61b1b9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lobac-ub-jafgfbaf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df8f2989bd2842c5d5b5f595da4d2352d495c7eb45e6f68a2d53a7519b9e7d15 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185001 Malicious code in sonic-kig-tnadeaxav (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2c2a114c5b200cc356c8e268c640d22ee5c5bd25c7e8eabdc30dc31c5397790 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-176669 Malicious code in nuilva-bavaim-madiaavo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce711a72e55145afd9763da28c1063e8958df6dcd5ce43da1caf2af6dd8c87ca This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-174762 Malicious code in hokage-26 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fa9f48421c4eec67b22b732ece1ea5af0a336ae90bbdc52a3c3f46d6a9e87d4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tray-uozp-pesustr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1b28262066c56edaa307aa7a2bc6de11f88076674b1fa2a82b9cf085131fae9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in unimna-safafi-naisffis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a89f9e9b5c97a52dd1b753de7d8e1397d162ec0a3a7bb6a48ce1795278cf695b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in miands-nutayu-esnuru (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a20564bff3bce1aab4d4b3c72e7a7860221d435a56bf7e3ec7a11cb797c2a15d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...