EUVD-2025-124323

Malicious code in nodemon-thuban-child-process-element-ui npm...

EUVD-2025-122335

Malicious code in sagitta-child-process-zenith-fork npm...

Malicious code in inquirer-child-process-concurrently-despina (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b2ddeddc56db997eedb9376c2bac0b0f00122edec437a41fa5927cb0001e8e8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in socketio-geckodriver-child-process-exec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 992519d57d5eaddeba7d0d897fcfd3a9290cc2d2f620518393717a638329adce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-112700

Malicious code in husky-child-process-lint-staged-dynamo npm...

EUVD-2025-120936

Malicious code in update-child-process-xerxes-postcss npm...

EUVD-2025-123518

Malicious code in postcss-loader-npm-child-process-gravity npm...

EUVD-2025-121871

Malicious code in socketio-geckodriver-child-process-exec npm...

EUVD-2025-121054

Malicious code in uglify-js-hexo-zenobia-child-process npm...

EUVD-2025-123268

Malicious code in promise-umbra-achernar-child-process npm...

Malicious code in child-process-foundation-eclipse-spectron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52c4f59859c4a243e08dd39070370b2f65a3c8c6d979f8032023e0bd0b311b12 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-122291

Malicious code in sagitta-xml-child-process-loopback npm...

MAL-2025-149883 Malicious code in zephyr-child-process-apollo-global (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74cdf2cdaee2edc3bdaa3dafa44c797d167187a3a3f86acedc1d2c42d0b8ced5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-114670

Malicious code in dactyl-epimetheus-child-process-pino-pretty npm...

Mozilla Firefox Code Execution Vulnerability (CNVD-2025-26886)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from a code execution vulnerability that is caused by the use of a WebGPU internal release triggered by an infected child process. An attacker could exploit the vulnerability to...

CVE-2025-12380 Use-after-free in WebGPU internals triggered from a compromised child process

Starting with Firefox 142, it was possible for a compromised child process to trigger a use-after-free in the GPU or browser process using WebGPU-related IPC calls. This may have been usable to escape the child process sandbox. This vulnerability was fixed in Firefox 144.0.2...

CVE-2025-12380

Starting with Firefox 142, it was possible for a compromised child process to trigger a use-after-free in the GPU or browser process using WebGPU-related IPC calls. This may have been usable to escape the child process sandbox. This vulnerability was fixed in Firefox 144.0.2...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox suffers from a code execution vulnerability that is caused by the use of a WebGPU internal release triggered by an infected child process. An attacker could exploit the vulnerability to...

Figma Developer MCP < 0.6.3 RCE (GHSA-gxw4-4fc5-9gr5)

The remote host has a version of figma-developer-mcp prior to 0.6.3. A command injection vulnerability exists in the figma-developer-mcp MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to childprocess.exec, enabling an attacker to inject arbitrary...

Security Vulnerabilities fixed in Firefox 144.0.2 — Mozilla

Starting with Firefox 142, it was possible for a compromised child process to trigger a use-after-free in the GPU or browser process using WebGPU-related IPC calls. This may have been usable to escape the child process sandbox...