Security Bulletin: NVIDIA Triton Inference Server - December 2025

NVIDIA has released a software update for NVIDIA Triton Inference Server to address the issue disclosed in this bulletin. To protect your system, install the latest release from the Triton Inference Server Releases page on GitHub, and view the Secure Deployment Considerations Guide. Go to NVIDIA...

EUVD-2025-179185

Malicious code in elara-triton-quasar-async npm...

Malicious code in centaurus-triton-library-resolvers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 508d04582683b1a2b69f84330b530a99d086493e9e8e58e18c5c504817462a69 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in yakutsk-luna-nova-triton (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1247a887e7b5c2f9fd964d4f486657e8b0b2f0cb3db19d32b6971e95515ac6f0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-175878

Malicious code in triton-meissa-indus-phenomic npm...

Malicious code in graphql-elektra-triton-transform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f32d98eba6cf6a31eff8d8c5f67b0544f7ea9333a54ebdc237767280fcbcf553 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-177719

Malicious code in mysql-local-bootes-triton npm...

EUVD-2025-175459

Malicious code in yakutsk-luna-nova-triton npm...

EUVD-2025-179813

Malicious code in centaurus-triton-library-resolvers npm...

EUVD-2025-178678

Malicious code in graphql-elektra-triton-transform npm...

MAL-2025-189998 Malicious code in triton-nconf-sublimation-grus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12da63b4396d0564a570e2e7b9c0edef188cfe7ae6d0a8b17c3822aaae97b572 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-175875

Malicious code in triton-proxima-impulse-dotenv-parse-variables npm...

EUVD-2025-177313

Malicious code in parsec-kaus-optimize-css-assets-webpack-plugin-triton npm...

EUVD-2025-179780

Malicious code in chalk-resonance-triton-mineralogy npm...

EUVD-2025-176659

Malicious code in rest-rocket-lint-staged-triton npm...

EUVD-2025-177375

Malicious code in paleoclimatology-draco-backend-triton npm...

EUVD-2025-176986

Malicious code in proteomics-electron-triton-child-process npm...

EUVD-2025-175873

Malicious code in triton-subduction-darkenergy-boson npm...

Malicious code in eclipse-triton-avior-yonder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e452f33f4d946135197dd190e23dc7ccad92501decc88c03373713cb28a1fcb2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in triton-meissa-indus-phenomic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 543a5fbe2c634835f233125fa69f909d389d897543417caaff9c6fb9f9c7a6ef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...