EUVD-2025-114537

Malicious code in dependencies-lacerta-hermes-install npm...

Malicious code in geckodriver-dependencies-ursa-thuban (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 747f5a78aa88b271647ec42d1c0e8110c547dda2c176ce3acd506e7f4aae8be8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-122806

Malicious code in redis-version-dependencies-zephyr npm...

EUVD-2025-113439

Malicious code in foundation-sync-jwt-dependencies npm...

Malicious code in dependencies-lyra-forever-heka (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8637e6125cafd55c9981aedd548b7e3f429b8fd732f4c1c4d35447b66db76ab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140354 Malicious code in callisto-winston-socketio-dependencies (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcc61cda68c18f9ee8fdafde47a595f3676d0480aa45bc379dd3acb84c0592d0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dependencies-lacerta-hermes-install (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 678c3892029c1b658f28fa5b4cc927adeb359d890e770612dd77011a83b270f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-114531

Malicious code in dependencies-radiant-centaurus-lyra npm...

EUVD-2025-116337

Malicious code in avior-dependencies-radiant-eridanus npm...

MAL-2025-141567 Malicious code in dependencies-equinox-despina-eclipse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39c683b2a7d937899f8905e90cc2f46225ee2a5764154d6b399d88a67ce7d677 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in guilty_ape_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 043177cf992ec44d41a3f6493eebddb9ab8f003042a9bb1381d0df595817ca1e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-98690 Malicious code in dutch_galliform_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 564c4c3d07d463ddb5695115f239373adfe2bf351e7d637a57bddbd898459bb2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dian-getas47-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94e86717a95348296454ce31bdb777604510ddf30616949757eab69ca74c93a4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-76661 Malicious code in ember-addon-with-dependencies (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 030efb54b3c7ce3807868d73f64d415effba5c936da7b4fad9b37a7e184fbff7 The package ember-addon-with-dependencies was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in ember-addon-with-dependencies (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 030efb54b3c7ce3807868d73f64d415effba5c936da7b4fad9b37a7e184fbff7 The package ember-addon-with-dependencies was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-70735 Malicious code in soviet-copper-sawfish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c610ef07f4b6e47a15a61fd1b1bb6e66da27eda0864d5520b02f8c7179035c3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Prototype Pollution

magix-combine-ex is vulnerable to Prototype Pollution. The vulnerability is due to improper input validation in the util-deps.addFileDepend function, which allows an attacker to inject malicious properties into Object.prototype, leading to denial of service DoS or other unexpected behavior...

[SECURITY] Fedora 43 Update: uv-0.9.7-2.fc43

An extremely fast Python package installer and resolver, written in Rust. Designed as a drop-in replacement for common pip and pip-tools workflows. Highlights: =E2=80=A2 =E2=9A=96=EF=B8=8F Drop-in replacement for common pip, pip-tools, and virtualenv commands. =E2=80=A2 =E2=9A=A1=EF=B8=8F 10-100x...

Fedora 43 : bpfman (2025-e67231423f)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-e67231423f advisory. This update fixes CVE-2025-0977 RUSTSEC-2025-0004, a use-after-free vulnerability in the Rust openssl crate's ssl::selectnextproto function. The openssl crat...

Fedora 42 : bpfman (2025-0753bddd6c)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-0753bddd6c advisory. This update fixes CVE-2025-0977 RUSTSEC-2025-0004, a use-after-free vulnerability in the Rust openssl crate's ssl::selectnextproto function. The openssl crat...