MAL-2025-51780 Malicious code in fadhil-enting55-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1182208c8cb9d1031ef389425725439edfd5ac112cfbe6cfdde2c92606d1c0f The package fadhil-enting55-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

Malicious code in tuti-lupis86-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 644ee3974a45ed9b4d2fbce12c79e14c3622570f56b0c280ba01b110649ce7ad The package tuti-lupis86-sukiwir was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flood...

MAL-2025-50856 Malicious code in arif-lapis5-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af04416435d09131ab8533275713b21fd7e5c02baec54881b7f51fc83914c622 The package arif-lapis5-sluey was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

Malicious code in candra-dradag91-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d69f180542bc46a9257d7ee9d9f5acbf4174fe17b22c88190bc72b9f90fe35d The package candra-dradag91-sluey was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

MAL-2025-51591 Malicious code in dono-jengkol69-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5527fba28c12e5de920712eab3631bf2adb27bcb12c101c91225ad7089809030 The package dono-jengkol69-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flood...

Malicious code in bamboo-init (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 913210ebd3bdb67c851e13118eff395e1df72403e313fcedfa4a1e9d4253746b The package bamboo-init was found to contain malicious code...

MAL-2025-51054 Malicious code in bella-liwet37-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1e8e3f929d2f0155657c3b256b172248e040e91a7a5f60b5ad19138d9feff06 The package bella-liwet37-breki was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that floode...

MAL-2025-51450 Malicious code in citra-sate14-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb62cc5423ff5d9078179f29746ea010686b11fb23567ff440fd15f6c887a761 The package citra-sate14-ruro was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

MAL-2025-51952 Malicious code in gibertserct12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b1430f9e3f043decd0a84c7c5bba26bb9eb4bcb9fc07ba0a9e1a0d9d3c025d7 The package gibertserct12 was found to contain malicious code...

Malicious code in react-icons-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 224e1d5b1a2b01321da822c843e2013f28320e4b9d4d74487daef59c812557f6 The package react-icons-toolkit was found to contain malicious code. Source: ghsa-malware...

[SECURITY] Fedora 43 Update: rust-reqsign-aws-v4-2.0.1-1.fc43

AWS SigV4 signing implementation for reqsign...

[SECURITY] Fedora 43 Update: rust-reqsign-0.18.1-1.fc43

Signing HTTP requests for AWS, Azure, Google, Huawei, Aliyun, Tencent and Oracle services...

Medium: libssh

Issue Overview: NULL Pointer Dereference vulnerability in the session ID calculation logic of the libssh library. The flaw arises from improper handling of allocation errors during cryptographic operations in the key exchange KEX phase. If a memory allocation fails, the resulting NULL pointer may...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: fs: dlm: fix invalid derefence of sblvbptr CVE-2022-50516 In the Linux kernel, the following vulnerability has been resolved: ext4: fix possible double unlock when moving a directory CVE-2023-53626 Affected...

Important: amazon-efs-utils

Issue Overview: regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those tunable mitigations already provide sane...

Low: thunderbird

Issue Overview: No CVE associated with this advisory Affected Packages: thunderbird Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum update thunderbird or yum...

Low: lz4

Issue Overview: No CVE associated with this advisory Affected Packages: lz4 Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum update lz4 or yum update --advisory...

Medium: fontforge

Issue Overview: FontForge v20230101 was discovered to contain a memory leak via the component DlgCreate8. CVE-2025-50949 Affected Packages: fontforge Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras...

Important: amazon-efs-utils

Issue Overview: regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those tunable mitigations already provide sane...

Important: webkitgtk4

Issue Overview: The issue was addressed with improved memory handling. This issue is fixed in Safari 26, visionOS 26, watchOS 26, macOS Tahoe 26, iOS 26 and iPadOS 26. Processing maliciously crafted web content may lead to an unexpected Safari crash. CVE-2025-43272 A correctness issue was address...