MAL-2025-93609 Malicious code in collective_sailfish_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e73678a88c2049242f8bc9082613554d48a1f1021f514449fb0c1f4de14b66f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-93610 Malicious code in collective_starfish_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 069a605fb8fa197e60b32ea1775950ef0daed61a99a73b1b0642fe2313b100a5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-64944

Malicious code in collectivestarfishz3n npm...

Malicious code in collective_catfish_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f788f8adcc3c840f9f7143c1d3c0daf9826bb1a0063c2f8c129cb502e6fdb1d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-64948

Malicious code in collectivecatfishz3n npm...

MAL-2025-93606 Malicious code in collective_catfish_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f788f8adcc3c840f9f7143c1d3c0daf9826bb1a0063c2f8c129cb502e6fdb1d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-64945

Malicious code in collectivesailfishz3n npm...

Malicious code in collective_whale_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 571dd6d577526467f8ebfc5d17d0e741a4392ce640cad07c373e86fc8acd545b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in collective-gray-minnow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab38bc3008641811ac958af7f76bc6ad5d60ae5a8f96aa8cac967ffb58bda6b4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-55375

Malicious code in collective-lime-finch npm...

EUVD-2025-55378

Malicious code in collective-amethyst-pinniped npm...

EUVD-2025-55377

Malicious code in collective-black-camel npm...

EUVD-2025-55376

Malicious code in collective-gray-minnow npm...

EUVD-2025-60272

Malicious code in collectiveswordtailz3n npm...

A Cybercrime Merger Like No Other — Scattered Spider, LAPSUS$, and ShinyHunters Join Forces

The nascent collective that combines three prominent cybercrime groups, Scattered Spider, LAPSUS$, and ShinyHunters, has created no less than 16 Telegram channels since August 8, 2025. "Since its debut, the group's Telegram channels have been removed and recreated at least 16 times under varying...

Are Voters Willing to Collectively Secure Elections? Unraveling a Practical Blockchain Voting System

Ensuring ballot secrecy is critical for fair and trustworthy electronic voting systems, yet achieving strong secrecy guarantees in decentralized, large-scale elections remains challenging. This paper proposes the concept of collectively secure voting, in which voters themselves can opt in as secr...

Crimson Collective: A New Threat Group Observed Operating in the Cloud

Introduction Over the past few weeks, Rapid7 has observed increased activity of a new threat group attacking AWS cloud environments with the goal of data exfiltration and subsequent extortion of the victim. This threat group refers to itself as ‘Crimson Collective’ and has recently announced that...

EUVD-2022-30984

Malicious code in bioql PyPI...

Secure One-Sided Device-Independent Quantum Key Distribution under Collective Attacks with Enhanced Robustness

We study the security of a quantum key distribution QKD protocol under the one-sided device-independent 1sDI setting, which assumes trust in only one party's measurement device. This approach effectively provides a balance between the experimental viability of device-dependent DD-QKD and the...

CVE-2022-4527

A vulnerability was found in collective.task up to 3.0.8. It has been classified as problematic. This affects the function renderCell/AssignedGroupColumn of the file src/collective/task/browser/table.py. The manipulation leads to cross site scripting. It is possible to initiate the attack remotel...