MAL-2025-159433 Malicious code in manadsi-sfadia-madav (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0c448598c1977ac9bf4d492d662848345d970476a0dd5a219cc820963a31949 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in transform-writable-farout-publish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bf92cfdd8e9ba325f1984bdf4531e1434e357d88a197cb1fa814f03eb07ac4c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in proxima-slidev-middleware-adonis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 344684591780ddb2924ad9c248fd8d91d956e9e4ffe38df0593aa3a037c0a957 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mdx-loglevel-meissa-meissa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 909e4c33893b2a01e7ce57de10e579ce8302c27633a661dfbed926ef6435f9d3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mdx-gemini-miranda-mysql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f28fccc481744cd6741ba11920c2b73942570a19cfb4e00807f6b56f3a72266 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in capella-docusaurus-zenith-ophiuchus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61d8b83ba1e1273709fdb0f009343f2a91021cb753fea822a25d8058d454d8a7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in json-centaurus-yakutsk-comet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf37872579d57c7904980d46accf7a399584cfd1c2f943c8c74688895d68442d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nina-toge82-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a951097e5e8104c62775f84067ac09d56cdca5079980c27fd0b97eacb8b600b0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eka-mie48-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6f5096c29d79df49ff195a3923146591785a2df7a2d72c42528776be0001dff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rifqi-rangginang71-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23c1bc79eb6dd638e3f449e8946fdd062057112c72cabd94ac902c16c9752c58 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-133987 Malicious code in hadi-telurtahu75-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35dec7aeed9e84b40c96d4259d8c2bfb49530aad7bed422a71e67de2f5bdab60 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tuti-saguer16-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 416eed654a1aef465c1b5d11d8a29594a499e477c1654a75e22441b4888f6f15 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in traditional_lamprey_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3f89b2d5a7903cea4c7973ff187686a4d18a3c2d3c1ade95c61bdb92a41f2b6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-93533

NVIDIA AIStore contains a vulnerability in AuthN. A successful exploit of this vulnerability might lead to escalation of privileges, information disclosure, and data tampering...

EUVD-2025-93536

NVIDIA NeMo Framework for all platforms contains a vulnerability in the bert services component where malicious data created by an attacker may cause a code injection. A successful exploit of this vulnerability may lead to Code execution, Escalation of privileges, Information disclosure, and Data...

EUVD-2025-93541

NVIDIA Megatron-LM for all platforms contains a vulnerability in a script, where malicious data created by an attacker may cause a code injection issue. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, data tampering...

EUVD-2025-93537

NVIDIA NeMo Framework for all platforms contains a vulnerability in a script, where malicious input created by an attacker may cause improper control of code generation. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and da...

CVE-2025-33178

NVIDIA NeMo Framework for all platforms contains a vulnerability in the bert services component where malicious data created by an attacker may cause a code injection. A successful exploit of this vulnerability may lead to Code execution, Escalation of privileges, Information disclosure, and Data...

CVE-2025-33186

NVIDIA AIStore contains a vulnerability in AuthN. A successful exploit of this vulnerability might lead to escalation of privileges, information disclosure, and data tampering...

CVE-2025-23357

NVIDIA Megatron-LM for all platforms contains a vulnerability in a script, where malicious data created by an attacker may cause a code injection issue. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, data tampering...