MAL-2025-68686 Malicious code in historical-black-dragonfly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37e0eb9d4d6c3cb66e340a4096b02600001636c5820972b399531013583122d5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-66930 Malicious code in basic-black-muskox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aac3bdfcb88e31f0a8582e86b3e8cace29280fd2601b6e45d43c3aaec8da5675 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-67786 Malicious code in distant-black-firefly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d3687641bfde87687e580cc2375259f9d9673ef0215e6057ba65fe3e5bb0c8a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-52262

Malicious code in right-black-tapir npm...

MAL-2025-71441 Malicious code in vicarious-black-bear (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6775f2f96fd0cdb9c76488da3896123cf7466e8d7399577ba71cd9b23b624b34 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-70006 Malicious code in primitive-black-aardwolf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4dfe87855174c088a2ec87c7aed327e66b191959562392664b638e573101948 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-68159 Malicious code in exclusive-black-hookworm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84e509df9e9f37bc6836c7b8ca7045fd36fe7c81b9385348fae638ece4a6d839 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-69737 Malicious code in oral-black-bison (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7f23a2bbed85773c9588699beee1b478fdb8da9b707da521c4d3fdbaa2f83f9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-70170 Malicious code in random-black-hippopotamus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0c27e868dd1984b108a28f8bf16bf8b556c1a7c6d18db157b22c5d77c7e8c97 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-71574 Malicious code in wide-black-narwhal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55392b535862c6ed90e2e9d1c91c276c997a843b931e069d2989c0c5c39573e4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

[SECURITY] Fedora 43 Update: ruff-0.14.3-1.fc43

An extremely fast Python linter and code formatter, written in Rust. Ruff aims to be orders of magnitude faster than alternative tools while integrating more functionality behind a single, common interface. Ruff can be used to replace Flake8 plus dozens of plugins, Black, isort, pydocstyle,...

JPRO: Automated Multimodal Jailbreaking Via Multi-Agent Collaboration Framework

The widespread application of large VLMs makes ensuring their secure deployment critical. While recent studies have demonstrated jailbreak attacks on VLMs, existing approaches are limited: they require either white-box access, restricting practicality, or rely on manually crafted patterns, leadin...

Quantifying the Risk of Transferred Black Box Attacks

Neural networks have become pervasive across various applications, including security-related products. However, their widespread adoption has heightened concerns regarding vulnerability to adversarial attacks. With emerging regulations and standards emphasizing security, organizations must...

Black-Box Guardrail Reverse-Engineering Attack

Large language models LLMs increasingly employ guardrails to enforce ethical, legal, and application-specific constraints on their outputs. While effective at mitigating harmful responses, these guardrails introduce a new class of vulnerabilities by exposing observable decision patterns. In this...

[SECURITY] Fedora 41 Update: ruff-0.14.2-1.fc41

An extremely fast Python linter and code formatter, written in Rust. Ruff aims to be orders of magnitude faster than alternative tools while integrating more functionality behind a single, common interface. Ruff can be used to replace Flake8 plus dozens of plugins, Black, isort, pydocstyle,...

SIRAJ: Diverse and Efficient Red-Teaming for LLM Agents Via Distilled Structured Reasoning

The ability of LLM agents to plan and invoke tools exposes them to new safety risks, making a comprehensive red-teaming system crucial for discovering vulnerabilities and ensuring their safe deployment. We present SIRAJ: a generic red-teaming framework for arbitrary black-box LLM agents. We emplo...

Enhanced MLLM Black-Box Jailbreaking Attacks and Defenses

Multimodal large language models MLLMs comprise of both visual and textual modalities to process vision language tasks. However, MLLMs are vulnerable to security-related issues, such as jailbreak attacks that alter the model's input to induce unauthorized or harmful responses. The incorporation o...

Separating Pseudorandom Generators from Logarithmic Pseudorandom States

Pseudorandom generators PRGs are a foundational primitive in classical cryptography, underpinning a wide range of constructions. In the quantum setting, pseudorandom quantum states PRSs were proposed as a potentially weaker assumption that might serve as a substitute for PRGs in cryptographic...

Multimodal Safety Is Asymmetric: Cross-Modal Exploits Unlock Black-Box MLLMs Jailbreaks

Multimodal large language models MLLMs have demonstrated significant utility across diverse real-world applications. But MLLMs remain vulnerable to jailbreaks, where adversarial inputs can collapse their safety constraints and trigger unethical responses. In this work, we investigate jailbreaks i...

SEO spam and hidden links: how to protect your website and your reputation

When analyzing the content of websites in an attempt to determine what category it belongs to, we sometimes get an utterly unexpected result. It could be the official page of a metal structures manufacturer or online flower shop, or, say, a law firm website, with completely neutral content, but o...