HSEC-2025-0006 Private key leak via inherited file descriptor

Private key leak via inherited file descriptor The X.509 key reading function readKeyFile opened a file descriptor to the private key without setting the close-on-exec flag. If a child process is execed at the same time, it would inherit that file descriptor and could read the private key materia...

Malicious code in xo-helios-child-process-pm2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6abf116ef5bd6a77aedf9bcc2b5428a4945e26fbf2e8c0d79a0fccebb457771 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-179309

Malicious code in development-child-process-npm-socketio npm...

Malicious code in acamar-child-process-oauth-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aecf9405e1356b230c3b5e02f074df3b4d1c15deed220a1ee0fa696389b7d321 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-175471

Malicious code in xo-helios-child-process-pm2 npm...

EUVD-2025-178819

Malicious code in fusion-gammarayburst-magnetosphere-child-process npm...

EUVD-2025-179736

Malicious code in child-process-stratigraphy-subduction-node-sass npm...

MAL-2025-186147 Malicious code in child-process-xenon-avior-perseus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9f4f073cd819427d81027c4347194f2093797d2605e1e90dbf83b1979f7d03c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-179738

Malicious code in child-process-eridanus-cypress-zephyr npm...

EUVD-2025-176986

Malicious code in proteomics-electron-triton-child-process npm...

EUVD-2025-175523

Malicious code in xanthus-child-process-radiant-biotechnology npm...

EUVD-2025-179264

Malicious code in dotenv-parse-variables-init-child-process-genomics npm...

Malicious code in hermes-child-process-apex-centauri (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a281ad403ce48fe80ffae106c96e750395afa994deaa511034c881291b3f006f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-180504

Malicious code in adonis-child-process-pegasus-repository npm...

EUVD-2025-179735

Malicious code in child-process-xenon-avior-perseus npm...

EUVD-2025-179739

Malicious code in child-process-concurrently-chakra-ui-node-sass npm...

MAL-2025-185384 Malicious code in adonis-child-process-pegasus-repository (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3209c8b1de00a411a153a4f8dbe6ad93c7dd53375702b75897914da7bd3baf36 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-180518

Malicious code in acamar-child-process-oauth-nodejs npm...

EUVD-2025-178540

Malicious code in hermes-child-process-apex-centauri npm...

Malicious code in zephyr-sadr-child-process-bootes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 146ecbbd3d8f2cb52b7a37a21f83f89b55640c24e6ac37ad73bd82f76b37752c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...