EUVD-2025-78218

Malicious code in stickylandfowlz3n npm...

Malicious code in sticky_barnacle_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75a0e4f6ea5fd14ac4d87e76bb37766d32f85f7881ea6119ddc99557cd69873d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-109125 Malicious code in sticky_guineafowl_0xrequest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44affd9617deb15fa045931e6f6e5c458e11b422553648aaa42be1deb9b2a068 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-84168

Malicious code in stickyjellyfishz3n npm...

MAL-2025-109126 Malicious code in sticky_jellyfish_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 877efe9b8673c12f9b02a2dba7d6de6675eded0f7be7c3fde69e2fc21d1b99a5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-66500

Malicious code in stickybatz3n npm...

EUVD-2025-66499

Malicious code in stickyeaglez3n npm...

Malicious code in sticky_bat_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aac10c97e706bb3e36ff1a6afdefadcb8ade533e590e4ff41d15ad4def15f101 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-66498

Malicious code in stickyherringz3n npm...

MAL-2025-65430 Malicious code in sticky_owl_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e1a87c7b78dcdd32241d3e92959c989920a3e8d63be022f0eb5b51d5ed43394 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sticky_pig_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45af53d67f87d7ebfc4a7014c0e4e573ad9922927f44a962373a9ff717d1ed3f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-45195

Malicious code in stickyangelfishz3n npm...

SoK: Systematizing a Decade of Architectural RowHammer Defenses through the Lens of Streaming Algorithms

A decade after its academic introduction, RowHammer RH remains a moving target that continues to challenge both the industry and academia. With its potential to serve as a critical attack vector, the ever-decreasing RH threshold now threatens DRAM process technology scaling, with a superlinearly...

EUVD-2025-37100

Malicious code in epic-sticky-header npm...

Malicious code in epic-sticky-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3f93b024d2bd95af1da3143d362d13057affff884e7980d67172e292296b68a The package epic-sticky-header was found to contain malicious code...

MAL-2025-49193 Malicious code in epic-sticky-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3f93b024d2bd95af1da3143d362d13057affff884e7980d67172e292296b68a The package epic-sticky-header was found to contain malicious code...

EUVD-2025-34930

Citizen vulnerable to stored XSS in sticky header button messages...

Citizen vulnerable to stored XSS in sticky header button messages

Summary The JS implementation for copying button labels to the sticky header in the Citizen skin unescapes HTML characters, allowing for stored XSS through system messages. Details In the copyButtonAttributes function in stickyHeader.js, when copying the button labels, the innerHTML of the new...

GHSA-G955-VW6W-V6PP Citizen vulnerable to stored XSS in sticky header button messages

Summary The JS implementation for copying button labels to the sticky header in the Citizen skin unescapes HTML characters, allowing for stored XSS through system messages. Details In the copyButtonAttributes function in stickyHeader.js, when copying the button labels, the innerHTML of the new...

CVE-2025-62508

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Citizen from 3.3.0 to 3.9.0 are vulnerable to stored cross-site scripting in the sticky header button message handling. In stickyHeader.js the copyButtonAttributes function assigns innerHTML from a source element’s...