CVE-2025-64429

DuckDB 1.4.0–pre-1.4.2 encryption implementation is vulnerable due to multiple cryptographic weaknesses: insecure RNG (pcg32 fallback), possible memory wipe omission (memset) leaving secrets, and header manipulation could downgrade from GCM to CTR, bypassing integrity. There may also be unhandled...

CVE-2025-64429 DuckDB Encryption Crypto implementation is vulnerable

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator pcg32 to generate cryptographic keys or...

EUVD-2025-150399

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator pcg32 to generate cryptographic keys or...

CVE-2025-64429 DuckDB Encryption Crypto implementation is vulnerable

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator pcg32 to generate cryptographic keys or...

CVE-2025-64429

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator pcg32 to generate cryptographic keys or...

CVE-2025-64429

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator pcg32 to generate cryptographic keys or...

Malicious code in teate-thy-sonic-irabik (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36f78c9b28880cc882bc9920e44709df64d9f9ccc3ba2676e516e04a7888e8e9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-180149 Malicious code in teate-thy-sonic-ajde (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d96952d5f948f72b7e674d6cd2852de6a7fc95bec7443edabe4df5f23bc82782 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-enewiw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6476e70fe779379f0cef8b4997e6c37537555d44e9e4168f770817d620cc226 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in anabuyil--nii (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21d98d2f86d29c33391f98a35b7f536787906f1c0fa5f709aab9580730d22c78 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-180037 Malicious code in teate-thy-py-ahucuc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3765cd6350287759df907ea12c0901cce80cdbc950dce311b6770a5a7df36f2e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-180441 Malicious code in teate-thy-sonic-gonad (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f4e7f83fb45b2ef02b39a6fab766567125d983f8e6868d533d744172971a361 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-cohil (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e70177c773a3da879b71106c376c6d3e180de66feda65a515d4fc7ae04239254 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kisut-dfg-dufadiuyban (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec0d27ad4b45b1e0b957176f23dc2e26f47c4d5387b3d3dd7ca01e750e7cdc3e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lookingan-jaja21 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9205c8decf05a14238aeba9177207e60d6d2170fde8545931048ab360a5b46c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kiut-acog-efiduufav (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b541d93e1c7c324e22f0e6c779eb5c15cf508672584d1d1776f715b65f0782f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-180308 Malicious code in teate-thy-sonic-dozzo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c167f038b244e115835ef16b59697421a5514499274451d89fe9b590106854a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-181085 Malicious code in teate-thy-sonic-weeli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba7a1ac34311fe37732c41198fdf00e87d819aeab590213f8592266ce16ded19 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-179944 Malicious code in lookingan-nanakila13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a5c81548df0b0a6981d5473b5720f27fcce9a31c8df59f8085dd10121e51385 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-bifgim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97fbd8c304ddf2eb9b4707b865b56df923532391b8f4952168cd980d71365263 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...