Malicious code in hermes-celeste-react-bootstrap-nodejs (npm)

The package hermes-celeste-react-bootstrap-nodejs was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in heka-react-bootstrap-electron-builder-puppeteer (npm)

The package heka-react-bootstrap-electron-builder-puppeteer was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in heka-hercules-react-bootstrap-darkenergy (npm)

The package heka-hercules-react-bootstrap-darkenergy was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in heka-bootstrap-javascript-loopback (npm)

Source: amazon-inspector 79bcabd4095430daa841c61c56b16ee60347e93be2e7f9c25d47d2a34c398593 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hadron-ophiuchus-bootstrap-lacerta (npm)

The package hadron-ophiuchus-bootstrap-lacerta was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in grunt-bootstrap-mongoose-elektra (npm)

Source: amazon-inspector 02da5fd610445f9d8951ce43052f42afb6e06fb32c013a06f436322f3aac6fc8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in gravity-react-bootstrap-commitlint-dynamo (npm)

Source: amazon-inspector cb22033e71a11b9b4e5ea920eae840ead86fee21e944aa895a89667612aee75e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in got-nightwatch-despina-react-bootstrap (npm)

Source: amazon-inspector 7336b107d179e0bff64553a286b8968070d2f42a5453b4c4ffc25c5a3be02ee7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in global-fornax-supervisor-react-bootstrap (npm)

Source: amazon-inspector c0acf146c879312a52c4a11dfd8019469b166ba992f23e25b1a184a8024ba6b9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

CVE-2026-15059 affecting package systemd-bootstrap for versions less than 250.3-20

CVE-2026-15059 affecting package systemd-bootstrap for versions less than 250.3-20. A patched version of the package is available...

CVE-2026-88939 knowns through 0.33.0 Authorization Bypass via project.set Bootstrap Exemption

knowns through 0.33.0 exempts the project.set action from permission guard checks unconditionally, allowing read-only agent sessions to bypass restrictions. Attackers can invoke project.set to repoint the server at another project directory and obtain write access capabilities...

CVE-2026-88939 knowns through 0.33.0 Authorization Bypass via project.set Bootstrap Exemption

knowns through 0.33.0 exempts the project.set action from permission guard checks unconditionally, allowing read-only agent sessions to bypass restrictions. Attackers can invoke project.set to repoint the server at another project directory and obtain write access capabilities...

CVE-2026-88939 knowns through 0.33.0 Authorization Bypass via project.set Bootstrap Exemption

knowns through 0.33.0 exempts the project.set action from permission guard checks unconditionally, allowing read-only agent sessions to bypass restrictions. Attackers can invoke project.set to repoint the server at another project directory and obtain write access capabilities...

WordPress Slider Bootstrap Carousel plugin <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Gilang - DJ in WordPress Plugin Slider Bootstrap Carousel versions = 1.0.7...

Malicious code in eslint-config-bootstrap-cosmos-eclipse (npm)

Source: amazon-inspector ddab306ab768aef4e01bcc7b04a30047de7b94dde56979b39615ba7937b0b938 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eridanus-react-bootstrap-telesto-yaml (npm)

Source: amazon-inspector b4fe8d301287a2cbf12ee63abb39ad3722dc93d2d21a760e22a0fa2a4727b4c8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in epimetheus-mensa-sedimentology-react-bootstrap (npm)

The package epimetheus-mensa-sedimentology-react-bootstrap was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in envconfig-wasat-bootstrap-rocket (npm)

Source: amazon-inspector af6db8e4f65d41c200bf215e85d07bcac6f0968a2f588d5aa3bf006697614914 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in envconfig-bootstrap-uglify-js-colors (npm)

Source: amazon-inspector 0bfd4098356c8ae408716b081b72671e5e811c3ef40bc851d469ae14849c5741 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in enif-react-bootstrap-gravity-apollo (npm)

Source: amazon-inspector 7366c6b2b849d14ce39d70c33c2606bc5ee97e6c0656befc2c46757026a36cf5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...