MAL-2025-156529 Malicious code in intan-20 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abf73f43860555012c3c7bfbfabe7db726f4a4145291c446a5345071d8342aab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nudela-aafof-gafi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1404cb1c2c3bd5a66d13e91931ac180faa4d79a80000142b715dac00ec111ff9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ilal-poke61 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90524f1a7811b86e041e73395f7d844803f1834e21080f379f9392b2c83a4434 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-163329 Malicious code in nokire-rara40 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e765ada07df74e78edf17b5f7d303707701238886de0481569e33d68a7c4b144 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-151750 Malicious code in aciyua-idust-dajauagaa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9487caed4f88c06300e56c16fce2b5ecca63687c378293fb671bbd954db6366 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-152662 Malicious code in andriani-poke5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82a2aa503ccae8d3704baa8cecbcd534bfe496f5c491923142c5eb8c0d624ad0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in manadsi-sdada-mivafida (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3477bc53f65d004f3956522cb39b04bb3492f4de77ffd5733b15f177a03cc82 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-153552 Malicious code in avomainah-frasu-ofuratrau (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b70eb6a3fff04f5df391bb447f76aa40674708c65ac58686c1bf1bb86579c879 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-152746 Malicious code in arif-poke38 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71dfa25e0165ddfb1ef7b114f92b755de9194dcff0365289d4cd7a344a61c77f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tealove-naiman28 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee47860caba95978cb2b0118470866c1e25fcf13d853a11d4a7e61fd3334f7d3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-167082 Malicious code in teagood-manaki19 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfe4cfdc4d4a3592ff4c9bef8ddb80fbad816ad9aca59b0f4819745232516598 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-11862

A security issue was discovered within Verve Asset Manager allowing unauthorized read-only users to read, update, and delete users via the API...

CVE-2025-40125

In the Linux kernel, the following vulnerability has been resolved: blk-mq: check kobject stateinsysfs before deleting in blkmqunregisterhctx In blkmqupdatenrhwqueues the return value of blkmqsysfsregisterhctxs is not checked. If sysfs creation for hctx fails, later changing the number of hwqueue...

kernel: ipv6: mcast: Delay put pmc->idev in mld_del_delrec()

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Delay put pmc-idev in mlddeldelrec pmc-idev is still used in ip6mcclearsrc, so as mldcleardelrec does, the reference should be put after ip6mcclearsrc return...

CVE-2025-12113

CVE-2025-12113 affects the WordPress plugin “Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images” (versions

Malicious code in async-phenomic-cygnus-markdown-pdf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 942ad617f9c6e35ff392813ea91ecd284c56b5f8e7d3beddf9829e2d1e25e539 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xenos-fusion-terser-transform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa9e52675c558394ae57cdd87ab9345caba594dbcea1608a9bff66bc6ab90bd4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in commitizen-chromedriver-flare-telesto (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47c39fe3bba442aca2cda6e7c18a2ffa40c87639f81952046f80fbff313e601f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mini-css-extract-plugin-nightwatch-ignite-capella (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd7abf768c17dcc0e5b07309564f07f447feb5c1795b58c7d519912d70485516 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143243 Malicious code in helios-xml-restart-dorado (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d63dc75a03aa2141802b7321311b220cc5902d8579b24371b901d0696be92c0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...