Malicious code in possible-indigo-cheetah (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4e42f7bb2da584bb623dcfe3deb3d494474369a7511cc67c356e3647c5c6c27 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cool-red-zebra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8184753473f86bfa6ce618d53ceefb38492f33d09c31543b608198058d9c91e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gita-sate76-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddecba660f5097aeb87df027d2f24edcbdb35d33625150d641e5125bcb2f9b9d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pretty_pike_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2beb0e99ac57a2f3f1a2ad789194abd7c8dd8ea424dfeef257c391945eff26a6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dynamic_gerbil_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0be82e339884d218c57d8edb77bc0d03618d84848837a041866fe45cfd908fc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fadhil-tapai63-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4be20d4499b98e6d79158608d4b080ad717bc932e79cf14f454e6ab54f9b754 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-63476 Malicious code in indah-klanting97-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0526d34d3bef4d31a476ece16ae53d45bc3a03a6c8faf009dbcb3f53d418ab1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-62829 Malicious code in erwin-soto72-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 657c2a0df441ed30828bb579b7c94819b13b10a960f13a75aa572b780f26b317 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vina-rangginang54-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10f5b194993eae1b62089fe0f9f8983376d88ee3bb46d2a21e1c12a1e6ce31db This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tiara-sego82-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3f078b44553e1977ae4eb7d4fcd66a730469d46246843ad69a3afbc53610edd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-46246

Name of the Vulnerable Software and Affected Versions Auto Amazon Links – Amazon Associates Affiliate Plugin versions prior to 5.4.4 Description The Auto Amazon Links – Amazon Associates Affiliate Plugin for WordPress is susceptible to unauthorized access to arbitrary files. This is possible...

Amazon Linux 2023 : pam, pam-devel (ALAS2023-2025-1257)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1257 advisory. A flaw was found in linux-pam. The pamnamespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to...

Amazon Linux 2 : amazon-ecr-credential-helper, --advisory ALAS2DOCKER-2025-079 (ALASDOCKER-2025-079)

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.10.1-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2025-079 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted value...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2025-1282)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1282 advisory. In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Check ssize for decryption and in-place encryption CVE-2025-40019 Tenable has extracted the preceding description blo...

Amazon Linux 2 : nerdctl, --advisory ALAS2-2025-3070 (ALAS-2025-3070)

The version of nerdctl installed on the remote host is prior to 2.1.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3070 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6 addresses...

Amazon Linux 2 : java-1.8.0-openjdk, --advisory ALAS2-2025-3072 (ALAS-2025-3072)

The version of java-1.8.0-openjdk installed on the remote host is prior to 1.8.0.472.b08-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3072 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product ...

Amazon Linux 2 : nerdctl, --advisory ALAS2-2025-3060 (ALAS-2025-3060)

The version of nerdctl installed on the remote host is prior to 2.1.5-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3060 advisory. go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data CVE-2025-11065 Tenable has extracted...

Amazon Linux 2023 : git-lfs (ALAS2023-2025-1258)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1258 advisory. Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository's working tree with the contents of Git LFS objects, certain Gi...

Amazon Linux 2 : qemu, --advisory ALAS2-2025-3061 (ALAS-2025-3061)

The version of qemu installed on the remote host is prior to 3.1.0-8. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3061 advisory. A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursoralloc function can lead to the...

Amazon Linux 2023 : xorg-x11-server-common, xorg-x11-server-devel, xorg-x11-server-source (ALAS2023-2025-1269)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1269 advisory. A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during notification creation can leave dangling pointers that...