OSV-2025-900 Heap-buffer-overflow in DecodeFrame

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=460575093 Crash type: Heap-buffer-overflow READ Crash state: DecodeFrame testdecoderprocess EsOutSend...

EUVD-2025-177886

Malicious code in meta-boolean-analyze-decode-cloud npm...

EUVD-2025-179688

Malicious code in code-interpret-finally-decode-cold npm...

EUVD-2025-176946

Malicious code in proxy-rain-decode-xi-error npm...

EUVD-2025-177751

Malicious code in mu-dog-proxy-decode-unix npm...

EUVD-2025-180123

Malicious code in bash-serialize-decode-grid-sudo npm...

EUVD-2025-176082

Malicious code in table-old-sun-await-decode npm...

Malicious code in quick-decode-transpile-array-wind (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 789be1eb5319667c7103faae653520c2ac40f78ca9957e497f34f7395845b3d5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-175752

Malicious code in user-boolean-info-decode-try npm...

EUVD-2025-179381

Malicious code in decode-info-new-finally-new npm...

EUVD-2025-180520

Malicious code in abstract-mu-kappa-authenticate-decode npm...

EUVD-2025-177475

Malicious code in old-import-decode-table-process npm...

EUVD-2025-176832

Malicious code in quick-decode-transpile-array-wind npm...

MAL-2025-190090 Malicious code in upsilon-decode-catch-log-function (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d0f728a55c388778d0b6ad28ccfe8a52b73fe5f721ab54b852d2982c0211dd1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-178288

Malicious code in java-socket-cluster-decode-catch npm...

EUVD-2025-179251

Malicious code in double-decode-encrypt-cache-bundle npm...

EUVD-2025-179382

Malicious code in decode-export-data-cold-error npm...

EUVD-2025-180201

Malicious code in authorize-signal-report-omicron-decode npm...

EUVD-2025-177473

Malicious code in old-string-protected-omega-decode npm...

Malicious code in upsilon-decode-catch-log-function (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d0f728a55c388778d0b6ad28ccfe8a52b73fe5f721ab54b852d2982c0211dd1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...