MAL-2025-56992 Malicious code in jaja-sroto92-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 574a1c409baaca90f88fc8e76b0562182b16dfc9a2bdf5ac2a14df69f8fdecc7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nadia-mieayam48-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec7cc63a40d92825c60d734f056c78d6508241df493c2f44b11a7aabe95f9175 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jaja-bika75-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f1ae7dd0b5fa8aa437cd64c170f2d92ccd9ce267d189b5704420374bc412a08 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mute_wolf_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9ff1ee9ae5629b987836126652938e30ddfcb68eb154bf7dfe3ad5c43baca48 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sinta-lepet71-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b45f9ad7e380edc016b78b2b99b254e54e5fd368919c2984ac1c5dc94802f6b8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-57934 Malicious code in ocha-keripik72-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5e1b72ee564c4d54d2b325eb0eb7b74556065e6a47d51cbff729323a3f81ac7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-57220 Malicious code in kurnia-gaplek28-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8b877d15351e20166409c8d899e71f25f00e4cf67d591e478ba8ce0f46e3213 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

9 Key Areas to Monitor for Potential Security Threats

The old "castle-and-moat" approach to security is a thing of the past. Your organization's perimeter is no longer a single, defensible line; it's a distributed and porous collection of remote employees, cloud services, and third-party vendors. Every connection is a potential entry point, and your...

Malicious code in siska-sambel43-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86d3e16cd1e8d58db474dd0d20f8a9b2eb2e69549c503e6499a24395ded29ce5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-54930 Malicious code in siska-rojak16-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 544400c991577e9a92f0d7d72337e176e93e803eb87f7cb77aab510fc03c0d9c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rina-kue15-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f16770dd6e24c35def1f83d21db3873ed2a3bbabf33930e0574b0d5c69d2b566 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hanafi-tapai69-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13f660fcf6201d787365c6d34ce6cc531c32a68b0f2a1b6f78d21ed83c350e72 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jaja-moci15-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37c284da4395ec0612633c3a81e9027ac879129b4fb84f33a5c5430cd280aff0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in joko-lontong64-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbae03aeff0cd20b74265ba31261ccef9b54422a89da67dafbe43c1767bacd28 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-53078 Malicious code in joni-tomat56-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca1ec4780e483f2dfd95b9a066a75a2a5c6eb57b247a51f5126950edf5091655 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eka-tomat89-sumpek (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9316055e8aac85f2aafdab145f406084277297c4a005769c25dec491fd7c3ff1 The package eka-tomat89-sumpek was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

Malicious code in citra-serimuka83-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b52fc037341fba2e106bc920ed34c2a6e6614ac273d1f4f5250fae4df4ede78 The package citra-serimuka83-miaww was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

thunderbird: firefox: An OBJECT tag type attribute overrode browser behavior on web resources without a content-type

A flaw was found in Thunderbird and Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resource served without a content-type. This...

CVE-2025-64181: Use of Uninitialized Variable

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.3.0 through 3.3.5 and 3.4.0 through 3.4.2, while fuzzing openexrexrcheckfuzzer, Valgrind reports a conditional branch depending on...

Incorrect Behavior Order

Overview ai is an AI SDK by Vercel - The AI Toolkit for TypeScript and JavaScript Affected versions of this package are vulnerable to Incorrect Behavior Order via the downloadAssets function. An attacker can upload files with disallowed types by substituting arbitrary downloaded bytes for differe...