Malicious code in yanti-mieaceh69-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbf95e2b88b0c92d2c3f557f316dde418cd0e6a2d46a2cfee2fe090e627377f4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vocational_fox_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ef1e26ed6f641576b0a3ec288636e8b2137058b0ad10143a51ff942fc98b212 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-61782 Malicious code in adequate_grasshopper_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc6641c3113af48a7c84bf316880d2c8300c6a11f42b0dff0a4788be2e11813f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-63115 Malicious code in gilang-kue75-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30cdc76b24ad2b7181029ee4c80fdb7918a8f4586cb2cbc0336f529a0bfb3148 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-65545 Malicious code in tania-rangi93-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14de977b611cde44bc4bd9f6134183d06c1a6fbe50fa84cdea3e4c2db00d12d8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-62485 Malicious code in dewi-kolak9-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0bc5184015c216da11395a005de56e1f9c24875159e262cd1929f51bacff211 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-63910 Malicious code in kurniawan-enting62-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05da15b684c08cb78a42b21ca101a6730679868326a556eb3c66f64948772299 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-62137 Malicious code in budi-ketan13-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17195204f9dd3542b36e55aa593fde640ea11c808c7a1c4e4fb88fc8417e630d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-62172 Malicious code in budi-taiwan40-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69ceece75f929ae57ca1376493fd6ee60a670269344014a4fd77f97b50aa5064 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-66004 Malicious code in vina-kupang90-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2ed09ca36c0e318862d03ba9433534079c81b8b7b71b705ece75487527dbf6b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-62550 Malicious code in dian-ronde49-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector caf0d123f97398ad8851a9e30bddff68edec51ae8987101c9e392e79791c06f7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-65078 Malicious code in rifqi-gaplek47-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f06685b5ed491268ec581abf9f51ecb96e662afc8776b5626f1ebf5368a68290 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in budi-kue35-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e31e00608ed936cb81b4d121637b016b6f6b34c5e3976ef38abad34c1bc82cba This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in laila-keripik74-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a36f32c6496b2b74458cb3f640eb8d0741a03287e581cf63e2d2ab80075eb46f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the WriteRelationships function when the exclusion operator is used in the authorization schema and the server is configured with --write-relationships-max-updates-per-call greater...

CVE-2025-64507

Incus is a system container and virtual machine manager. An issue in versions prior to 6.0.6 and 6.19.0 affects any Incus user in an environment where an unprivileged user may have root access to a container with an attached custom storage volume that has the security.shifted property set to true...

CVE-2025-64508 Bugsink vulnerable to unauthenticated remote DoS via crafted Brotli input

Bugsink is a self-hosted error tracking tool. In versions prior to 2.0.5, brotli "bombs" highly compressed brotli streams, such as many zeros can be sent to the server. Since the server will attempt to decompress these streams before applying various maximums, this can lead to exhaustion of the...

CVE-2025-49145

Combodo iTop vulnerability CVE-2025-49145 affects iTop versions prior to 2.7.13 and 3.2.2. A user with sufficient rights to create webhooks (typically administrators) can trigger database deletion due to unverified callback signatures. The issue is mitigated in iTop by upgrading to 2.7.13 or 3.2....

Hackers Exploiting Triofox Flaw to Install Remote Access Tools via Antivirus Feature

Google's Mandiant Threat Defense on Monday said it discovered n-day exploitation of a now-patched security flaw in Gladinet's Triofox file-sharing and remote access platform. The critical vulnerability, tracked as CVE-2025-12480 CVSS score: 9.1, allows an attacker to bypass authentication and...

Malicious code in alert_wallaby_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3ad9c1de1fb9aa671f090cfb0125a40edd17f49e9219d02f97c5d3fac728730 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...