Malicious code in surrounding-brown-quail (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f50e6ab0fb53662f4acfde859c15c63d52942230aaf07124a28d5deee928d9b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dewi-liwet5-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e9d86db16395869177d3bbe78fb35b3441a06bad028ba0ede5847f446cac432 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in willowy_macaw_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cefdb7df8a9e835c55c6a96f72e5e2117cc03745fbe0abb2273cae32ecaeb8a5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in remote_cheetah_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f563b8e7798842288a06d60d3de5a65a84740962fda070afee806b1d1772451 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rina-serimuka68-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bcbaa06fff35e2076932ff2b7709e6759de3be7bc45c5d8830cdf448e7d83d9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in yuni-tahutek36-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a7ce1065ae1f34972e7a281b97fe3799fcbe608ce797d5b9720beb7c983fd7e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Security update for chromium (critical)

openSUSE security update: security update for chromium ------------------------------------------------------------- Announcement ID: openSUSE-SU-2025-20020-1 Rating: critical References: bsc1250472 bsc1250780 bsc1251334 Cross-References: CVE-2025-10890 CVE-2025-10891 CVE-2025-10892 CVE-2025-1120...

Moderate: Red Hat Security Advisory: Insights proxy Container Image

Initial GA Release of Red Hat Insights proxy The Insights proxy Container is used by the Insights proxy product RPM and serves as an intermediary between cystomer systems in disconnected networks, air-gapped systems or systems with no outside connections and Insights. The Insights proxy routes al...

MAL-2025-60249 Malicious code in defeated_wolverine_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1941de890329abb0f4620890118be41ca6a2e2c098fa5eed7faa94677804895 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in willing_basilisk_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6316c449f0221d5a3f795ad3d1c50c32fc01801df5efeb31530d9786f06a4194 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in inappropriate_barracuda_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0decac8007639671c57c0bd382caec241f058e165de7eb34a5a1ea96def51c97 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hadi-kentang33-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5d1121994eb9fed5a92c1918bced7cb93f4cd83ee912662dae8d9f45725e092 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gita-ronde83-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01304424880bcb7a422cfe9ad5f758bb58bd1c8348e95d2514b762887516c6c8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-58510 Malicious code in rina-toge32-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7ded4945afb7fb2a3086aca2b49fb8a9e3e74c8f422478ad8ea064e63348970 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Watch out for Walmart gift card scams

You’ve probably seen it before—a bright, urgent message claiming you’ve qualified for a $750 or $1000 Walmart gift card. All you have to do is answer a few questions. It looks harmless enough. But once you click, you find yourself in a maze of surveys, redirects, and "partner offers"—without ever...

A week in security (November 3 – November 9)

Last week on Malwarebytes Labs: Malwarebytes scores 100% in AV-Comparatives Stalkerware Test 2025 Fake CAPTCHA sites now have tutorial videos to help victims install malware Hackers commit highway robbery, stealing cargo and goods Android malware steals your card details and PIN to make instant A...

MAL-2025-54360 Malicious code in putri-lepet3-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d357054bec37c192f7fb18af36f8bbd9e2d4ce5c0829c3858d528267da88732 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in putri-rangginang31-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac57c19a0d2535a390b5a465e673b3bb47e922afe7f0d8ed64bd7e5f979c9bfc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Singling out People without Knowing Their Names - Behavioural Targeting, Pseudonymous Data, and the New Data Protection Regulation

Information about millions of people is collected for behavioural targeting, a type of marketing that involves tracking people's online behaviour for targeted advertising. It is hotly debated whether data protection law applies to behavioural targeting. Many behavioural targeting companies say...

Microsoft Uncovers 'Whisper Leak' Attack That Identifies AI Chat Topics in Encrypted Traffic

Microsoft has disclosed details of a novel side-channel attack targeting remote language models that could enable a passive adversary with capabilities to observe network traffic to glean details about model conversation topics despite encryption protections under certain circumstances. This...