Malicious code in indea-fodioj-agajonafau (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35fe241d9432e5a1913fa9a6abbb308f5b0c73fdeec93ca8409cd548bfa32e66 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-40181

In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP When running as an SNP or TDX guest under KVM, force the legacy PCI hole, i.e. memory between Top of Lower Usable DRAM and 4GiB, to be mapped as UC via a forc...

CVE-2025-40181

In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Force legacy PCI hole to UC when overriding MTRRs for TDX/SNP When running as an SNP or TDX guest under KVM, force the legacy PCI hole, i.e. memory between Top of Lower Usable DRAM and 4GiB, to be mapped as UC via a forc...

Malicious code in lookingan-nalako98 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b60c9fcd95cd993c92436cacd87324d243f4c586647a0868a70bd969348b403e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ultra-terser-capella-tethys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b1313e3e3f93703b6b22a59de9916d11ccb6378d4b340b02f531a428f1b8515 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142114 Malicious code in epimetheus-zephyr-cygnus-cypress (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 126408fe26e034015b137d865bf1fb63593a019521549e408cbab133a62fd25d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Evervault Go SDK 数据伪造问题漏洞

Evervault Go SDK is an open source development toolkit from Evervault. A Data Forgery Issue vulnerability exists in Evervault Go SDK versions prior to 1.3.2, which stems from incomplete validation logic that could lead to trusting an enclave operator that does not meet integrity guarantees...

Malicious code in vina-nasiuduk21-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52bfde403c18a9ae732d58e17b4fea56dd327b38445cdd1c3919396f72f2ba1a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

kernel: x86/tdx: Fix "in-kernel MMIO" check

A flaw was found in the Linux kernel. Userspace can deceive the kernel into performing MMIO Memory-Mapped IO operations in TDX Trust Domain Extensions on its behalf, allowing a VE Virtualization Exception to be incorrectly handled as a in-kernel MMIO operation...

MAL-2025-110593 Malicious code in vitreous_camel_dumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 239bdfe43105e45117afe9fbe176eb5e44767e696ae4fe09dc765d9a80077bf2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in entire_panda_dumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8b7f299adfaac9264558e13146b847616615e1f07eba90bf54a9d6b3c6437b9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Siemens Solid Edge SE2025 信任管理问题漏洞

Siemens Solid Edge SE2025 is a development software from Siemens Germany. A trust management issue vulnerability exists in versions prior to Siemens Solid Edge SE2025 V225.0 Update 11, which stems from not properly validating client certificates and could lead to a man-in-the-middle attack...

Lite XL Arbitrary Code Execution via Project Module and Legacy system.exec Function

Overview Lite XL is a lightweight text editor derived from the lite project, written primarily in Lua and C. It supports Windows, Linux, and macOS, and is designed for extensibility through plugins and project‑specific modules. Description Two vulnerabilities were identified Lite XL: CVE-2025-121...

NVIDIA AIStore 信任管理问题漏洞

NVIDIA AIStore is a lightweight storage stack designed for AI applications from NVIDIA. NVIDIA AIStore suffers from a trust management issue vulnerability that stems from a flaw in AuthN that could lead to elevated privileges, information disclosure, and data tampering...

SAP SQL Anywhere 信任管理问题漏洞

SAP SQL Anywhere is a SAP-specific relational database management system from SAP, Germany. A trust management issue vulnerability exists in SAP SQL Anywhere, which arises from hard-coded credentials in the code, and could lead to arbitrary code execution, impacting the confidentiality integrity...

curl: Silent TLS Trust Model Hijacking via `CURL_CA_BUNDLE` Environment Variable Leads to MITM

Summary: curl is vulnerable to silent Man-in-the-Middle MITM attacks due to its design, which implicitly trusts the CA certificate path specified in the CURLCABUNDLE environment variable. This mechanism allows the entire TLS trust model chain of trust of curl to be hijacked without any warning or...

Malicious code in yuni-enting49-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e43cafc4a193140ad1f8ff6d5c352949e215647b4e1904bfc4b7dc1a9dbac31 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Incident Response Team (ShieldForce) Partners with AccuKnox for Zero Trust CNAPP in Latin America

Menlo Park, CA, USA, 10th November 2025, CyberNewsWire...

Redefine Trust with Web Bot Authentication

...

Malicious code in bambang-ronde54-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7d658f4894311474a85763465858f096b61d343eadfb24d20fdbcb4309a4402 The package bambang-ronde54-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...