3258 matches found
Malicious code in less-loader-react-bootstrap-cosmicray-spectroscopy (npm)
Source: amazon-inspector 34b22a3237ae7e67de2b1fded90e8aad83a6fa3a88ed44ce7d4329367a38aa5d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
CVE-2026-54581
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchbootstrapindex function in libmport/fetch.c could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserve a fatal result. A network attacker or...
CVE-2026-54581
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchbootstrapindex function in libmport/fetch.c could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserve a fatal result. A network attacker or...
EUVD-2026-82318
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchbootstrapindex function in libmport/fetch.c could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserve a fatal result. A network attacker or...
CVE-2026-92972 SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint
SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the KV transfer routing table. Attackers can supply arbitrary rankip and rankport values to redirect decode workers to...
EUVD-2026-81581
SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the KV transfer routing table. Attackers can supply arbitrary rankip and rankport values to redirect decode workers to...
CVE-2026-92972 SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint
SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the KV transfer routing table. Attackers can supply arbitrary rankip and rankport values to redirect decode workers to...
Malicious code in lacerta-deneb-react-bootstrap-gravity (npm)
Source: amazon-inspector 8ee4a9712b532e871f7b4ddaa054d992da7855fe931e1bc6d0a47c71aa8e651e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in lacerta-dotenv-parse-variables-charon-bootstrap (npm)
Source: amazon-inspector 655f0990025331f26bea8ba9a4718b3206e5931ea8fefccd766e369c6312c564 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in koa-module-bootstrap-spica (npm)
Source: amazon-inspector 91a4cb222471bc51975749e78a4951f374ebdaaf33f053ab57fbcd73c4c00e15 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in kinetic-ora-bootstrap-redshift (npm)
Source: amazon-inspector 9c94144702a359f66450437efd957137a56b3bce619a4b13ed508a050d09d69e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in karma-fornax-react-bootstrap-draco (npm)
Source: amazon-inspector 692a2c9da87e3f2f27a132a25c2aa343f1b3f5c7d705d7a5a74fbdca38cf1da0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in jwt-telesto-bootstrap-ophiuchus (npm)
Source: amazon-inspector 3e8e9921872e0584a4359c709971f101c91881e4b879963244f8b683d3c58d81 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in jupiter-react-bootstrap-sedimentology-prettier-stylelint (npm)
The package jupiter-react-bootstrap-sedimentology-prettier-stylelint was found to contain malicious code. --- Credit: OpenSSF source...
Malicious code in juno-sirius-react-bootstrap-weywot (npm)
Source: amazon-inspector 1187ba054fc9b46477a91275100c1ebc2b34469d8a5e8314d2cfb9fe05d71488 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in jovian-asteroid-tectonophysics-bootstrap (npm)
Source: amazon-inspector bb9ecc1569f3eb6c25f454d0d132e550cf8451e776e85bf56a54a04955aaab97 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
CVE-2026-54581: Insufficient Verification of Data Authenticity
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchbootstrapindex function in libmport/fetch.c could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserve a fatal result. A network attacker or...
PT-2026-95003
Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description The mport fetch bootstrap index function in libmport/fetch.c fails to preserve a fatal result when bootstrap index hash verification encounters a missing or invalid hash, incorrectly returning success...
PT-2026-94337
Name of the Vulnerable Software and Affected Versions SGLang versions prior to 0.5.20 Description When operating in prefill/decode disaggregation mode, the prefill bootstrap service exposes an unauthenticated PUT '/route' endpoint. This allows an attacker to poison the KV transfer routing table b...
