EUVD-2025-123267

Malicious code in promise-ursa-testcafe-spawn npm...

EUVD-2025-115794

Malicious code in callback-restart-spawn-cordelia npm...

EUVD-2025-116874

Malicious code in aether-cli-ariel-spawn npm...

Malicious code in mongodb-spawn-ursa-jasmine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0aac006721f2dd7978db07e64591af28893d16f07f61a47b2d7eac7fb0fed7fd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ursa-spawn-writable-acamar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98529c833cbb87e017a27e085a759a2b5c2daa8f6c81183a5d835f87821f4d84 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-111993

Malicious code in karma-spawn-webpack-yonder npm...

Malicious code in eris-spawn-lynx-testcafe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14bca2ce67e69c781a2f7322159d6df5b7e238d726cee97432e040ca27711aaa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-114775

Malicious code in css-minimizer-webpack-plugin-transport-spawn-command npm...

Malicious code in spawn-figures-async-loglevel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56662d4f8f23678a960291b8d19f3aa545e75a2346fcb87bce99a7c591855648 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148240 Malicious code in sqlite-spawn-ultra-eclipse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3be06e9b3e8c2658261f00ccc757cc103e2be3f4c5ae7c655f5dd153755439ee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-121685

Malicious code in sqlite-spawn-ultra-eclipse npm...

MAL-2025-147814 Malicious code in selenium-spawn-graphql-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15bb56bc9a2d81ce14a1bcff9a5dbebd2ee2ca22986cf4b6b12e88a5f9903b15 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140205 Malicious code in bulma-blaze-europa-spawn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2187e3df5f25fa89e7d582ad2b49cb8dd54a88d1dc8b42e7694934d80e7d5b99 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145799 Malicious code in odin-mira-spawn-protractor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53aa37a11a06e592a83031a43a7cd565dfb52011bdb1eddb5c685681580c515f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-131184 Malicious code in wati-nasi31-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22b62bdd8bb3ef3715ffb99157ce4556fff230a13a94a9e9386c3fbdf826b89f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-76173 Malicious code in wawan-kacang97-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c3481849aeccab32d0e4fc8feb25e14eaaf16132ea6d85fa2eb9251ae40c667 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tiara-miemee99-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37002bc3d9b417de9102e657e18767c1a66286588e129bc5609c25d689f932f1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in iwan-telur91-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0948d6b17113169f89a36c7f264cb43c47f816c5d57f124e302327a478c053b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which are vulnerable to CVEs.

Summary IBM Maximo Application Suite uses "form-data 4.0.0, org.apache.cxfcxf-core 3.6.7 , net/http/internal v1.24.1, braces 3.0.2 , cross-spawn 7.0.3 , crypto/x509 1.24.1 1.24.3 , github.com/golang-jwt/jwt/v4 github.com/golang-jwt/jwt/v5 v4.5.0 v5.2.1 , httpd 2.4.37 , setuptools 78.0.2 75.8.0 ,...

Security Bulletin: IBM Maximo Application Suite - Manage Component uses cross-spawn-6.0.5.tgz which is vulnerable to CVE-2024-21538

Summary Security Bulletin: IBM Maximo Application Suite - Manage Component uses cross-spawn-6.0.5.tgz which is vulnerable to CVE-2024-21538. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2024-21538 DESCRIPTION: Versions of the...