MAL-2025-57060 Malicious code in joko-sambel4-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5273486ff7080abc69b613e277f01a8fe7dbe3feaada306f86df93dd83d75c44 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-53268 Malicious code in lisa-teh10-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f3f0cdef42811f9ddc5bc4de57e6affd5fa5b7dcdb6cea3ff075a7fb663843f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vina-sambel18-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1909bcee00ef2492d9b00a1876b80a2eb69972c7c4706743ef73b332c682c6d4 The package vina-sambel18-sukiwir was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

[SECURITY] Fedora 43 Update: rust-attribute-derive-0.10.5-1.fc43

Clap like parsing for attributes in proc-macros...

[SECURITY] Fedora 43 Update: rust-attribute-derive-macro-0.10.5-1.fc43

Clap for proc macro attributes...

[SECURITY] Fedora 43 Update: rust-get-size-derive2-0.7.0-1.fc43

Derives the GetSize trait...

[SECURITY] Fedora 42 Update: rust-get-size-derive2-0.7.0-1.fc42

Derives the GetSize trait...

[SECURITY] Fedora 42 Update: rust-attribute-derive-0.10.5-1.fc42

Clap like parsing for attributes in proc-macros...

[SECURITY] Fedora 42 Update: rust-attribute-derive-macro-0.10.5-1.fc42

Clap for proc macro attributes...

[SECURITY] Fedora 41 Update: rust-attribute-derive-0.10.5-1.fc41

Clap like parsing for attributes in proc-macros...

[SECURITY] Fedora 41 Update: rust-attribute-derive-macro-0.10.5-1.fc41

Clap for proc macro attributes...

EUVD-2023-29184

Malicious code in bioql PyPI...

EUVD-2022-0554

Malicious code in bioql PyPI...

EUVD-2022-0715

Malicious code in bioql PyPI...

EUVD-2023-30887

Malicious code in bioql PyPI...

RUSTSEC-2025-0058 custom_derive crate is unmaintained

The customderive crate is no longer actively maintained. If you rely on this crate, consider switching to a maintained alternative. Recommended alternatives - strum - macro-attr...

custom_derive crate is unmaintained

The customderive crate is no longer actively maintained. If you rely on this crate, consider switching to a maintained alternative. Recommended alternatives - strum - macro-attr...

The vulnerability of the ThrowException() function in the Node.js software licensing model allows a violator to trigger a service failure.

The vulnerability of the ThrowException function in the Node.js software licensing model is related to an error in handling exceptional states during the processing of the SignTraits::DeriveBits method. Exploiting this vulnerability could allow a malicious actor to trigger a service failure...

The C++ method SignTraits::DeriveBits() may incorrectly call ThrowException() based on user-supplied inputs when executing in a background thread, crashing the Node.js process. Such cryptographic operations are commonly applied to untrusted inputs. Thus, this mechanism potentially allows an adversary to remotely crash a Node.js runtime.

...

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: nodejs: Remote Crash via SignTraits::DeriveBits in Node.js CVE-2025-23166 For more details about the security issues, including the impact, a CVSS...