7257 matches found
EUVD-2025-177402
Malicious code in orogeny-quark-archaeoastronomy-auth npm...
MAL-2025-190383 Malicious code in xerxes-auth-jekyll-ionosphere (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51ad4f9df284c5088fa33be03291602f134c74a08bde68bd1d24c3220134e5cb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-189608 Malicious code in spectron-grunt-auth-europa (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6cbd342d4b73f3ab91a46f07b5ec0f8fb7ea8893422949f32cb9b9cae1c1dc1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
CVE-2025-64517
sudo-rs (Rust implementation of sudo) is affected by CVE-2025-64517. Versions prior to 0.2.10 incorrectly recorded the invoking user’s UID in the authentication timestamp when Defaults targetpw/rootpw are enabled, which could allow a highly-privileged user to run commands as other accounts using ...
CVE-2025-40187 net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
In the Linux kernel, the following vulnerability has been resolved: net/sctp: fix a null dereference in sctpdisposition sctpsfdo51Dce If newasoc-peer.adaptationind=0 and sctpulpeventmakeauthkey=0 and sctpulpeventmakeauthkey returns 0, then the variable aiev remains zero and the zero will be...
CVE-2025-63666
Tenda AC15 v15.03.05.18multi issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the session identifier. An attacker with network access or the ability to run JS in a victim browser can steal the cookie and replay it to acce...
CVE-2025-40129 sunrpc: fix null pointer dereference on zero-length checksum
In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix null pointer dereference on zero-length checksum In xdrstreamdecodeopaqueauth, zero-length checksum.len causes checksum.data to be set to NULL. This triggers a NPD when accessing checksum.data in gsskrb5verifymicv2...
EUVD-2025-116372
Malicious code in auth-radiant-kastra-standard npm...
EUVD-2025-121862
Malicious code in socketio-rollup-plugin-vuetify-auth npm...
EUVD-2025-115836
Malicious code in cache-eridanus-auth-perseus npm...
EUVD-2025-115323
Malicious code in cli-auth-elara-sedna npm...
Malicious code in rigel-module-ariel-auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5430b6080ec3b26d7c4d27ebfc869276db25cfcba262c4909bdcdd3fc72261c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in titan-auth-websockets-algol (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 433a1f1238fa18babfb7cdb34edd93e4b23abddb489dead658c27f8f3aec0a08 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-116369
Malicious code in auth-venus-request-vega npm...
Malicious code in draco-auth-resolvers-html-webpack-plugin (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e01a1e333d58856b3ce23766018ec3198d0aa4fc6404f150f0c457c256b1d104 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-112982
Malicious code in halley-auth-vega-eslint-plugin npm...
MAL-2025-142367 Malicious code in express-auth-registry-markdownlint (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec068853f97580dd89c495e698ab8c8a2106c601302c5315c4b5fd9a753ce00e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-147195 Malicious code in relay-auth-cassini-winston (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bf7a75cf1af94a450e995779c3a4f00f61ffd14df9177e7fd4aea774699e5e3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...