TencentOS Server 2: thunderbird (TSSA-2024:0132)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0132 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

Securing AI Agents against Prompt Injection Attacks

Retrieval-augmented generation RAG systems have become widely used for enhancing large language model capabilities, but they introduce significant security vulnerabilities through prompt injection attacks. We present a comprehensive benchmark for evaluating prompt injection risks in RAG-enabled A...

JavaScript Expression Evaluator 安全漏洞

JavaScript Expression Evaluator is a math calculator by Matthew Crumley Personal Developer. A security vulnerability exists in JavaScript Expression Evaluator that stems from prototype contamination and could lead to the execution of arbitrary code...

JS-YAML 安全漏洞

JS-YAML is a JavaScript YAML parser and dump from Nodeca Open Source. A security vulnerability exists in JS-YAML version 4.1.0 and earlier, which stems from the possibility of modifying prototypes when parsing YAML documents, potentially leading to prototype contamination...

Malicious code in moki-nik-hifdagujbagaifah (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fb462c66586c367e7fe5639a99621f4a69a8df103a5401bc440e572579a809d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-180481 Malicious code in teate-thy-sonic-hudfe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbee838f9f6629b391fc7a88745160312e5d815f1108c24747e7d6d95d1ee76c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in stellarhunter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector efde1a229d98659ff10d9a0ae02fb6d05b769d1679df279190c1e2b23ebb9805 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-166858 Malicious code in teagood-cuekin89 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b1f214244ff59309cc7d9b75787074f4677550e424b92785097f9813dffa8f6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in inufgi-gobagilai-janigaga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 861fe22493250b154930bbdb5aaf83f7f80cf1c8bd2bc077bfce3556fd5853c1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-167047 Malicious code in teagood-lokina79 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef36a7558fbe0e4bf398c0cb01ad8c4ee51a0b794d1e55f20e38172a0eb998f5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in standard-aquarius-css-loader-webdriver-mocha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec05f0a48a6171709e472121b4da1b9b84e2fb0444facebb8acd27d908e38b1b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in blitz-nodejs-postcss-umbra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45892fb45c9f93ca8fd5b90a65388042f2205a48413aa509a34733d2c1d972cd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142436 Malicious code in fetch-celeste-link-quantum (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ecd7a1846ff262e5c7b508f4b84abf81c837205c5ccd7d9dc7f3b32ee0d35ea0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139954 Malicious code in bellatrix-protractor-fomalhaut-css-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f4aa076d16605f852f34a40ab150b55bcd62c3c8df33c8f1fa61916e50f8113 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142515 Malicious code in firebase-server-miranda-jupiter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector beb4a7fb178cd7eadc112d909aa87f187fb04dd8148d9afd9a0ff5227a5d61e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-126564 Malicious code in fitri-gulai24-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11f4158c6be66fe91dc41a974e941ee78ea87955acb0d90e7e33eb2586ac4f89 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-116258 Malicious code in oktafian-getas91-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e03984e55331ff69b3362fc64ecd66671c4eaa6db194722ba935941e9c91ace This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-103099 Malicious code in genuine_herring-notthedevs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18d29369f456300a389ed83a5095cf4080e0949835123621b77fced63f079cce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in indah-jus94-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector faa5a069f51b4b31e0dead11e38de0753c2bfb9e4644af40653edc95b952f6df This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tiara-gaplek54-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5030c856d5dd632f32549bf04836aca20e24da73b598b3d987d2aa921add2edc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...