Malicious code in hercules-command-spawn-hapi (npm)

Source: amazon-inspector 3030966dba1217b52bd7006495cc4dc383992f2e938a0b1d7f30e30921020daf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

EUVD-2025-112837

Malicious code in hercules-command-spawn-hapi npm...

Uptime Kuma Authenticated remote code execution via TailscalePing

Summary The runTailscalePing method of the TailscalePing class injects the hostname parameter inside a shell command, leading to a command injection and the possibility to run arbitrary commands on the server. Details When adding a new monitor on Uptime Kuma, we can select the "Tailscale Ping"...