Malicious code in trigo-react-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b342d6dbb3287df2002c455ce23553f3aa118b46e447741fa840397425741076 The package trigo-react-app was found to contain malicious code. Source: ghsa-malware 11f63c9b322a04a69d7c2c875302dfe971081157a6ea2c3360e65c5e4f9f5a9...

MAL-2025-190628 Malicious code in hash-guard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b2ca55ce577caa1adabc53a3513e7b1d739be9cf9870f502d0dce75b44e2540 The package hash-guard was found to contain malicious code. Source: ghsa-malware 7c7e7dba950f2d191fe82c46ed3f9abd10509690b07fb3f1fb97f0ec39ff4304 Any...

PT-2025-47950

Name of the Vulnerable Software and Affected Versions keylime affected versions not specified Description A flaw exists in keylime that allows an attacker to register a new agent using a different Trusted Platform Module TPM device while claiming an existing agent’s unique identifier UUID. This...

CVE-2025-65111

CVE-2025-65111 affects SpiceDB prior to version 1.47.1. Affected behavior: when a schema defines a permission as a union and the union references the same relation on both sides (but one side points to a different permission), the LookupResources API may return incomplete results. Other APIs calc...

CVE-2025-65111 SpiceDB's LookupResources with Multiple Entrypoints across Different Definitions Can Return Incomplete Results

SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a schema includes the following characteristics: permission defined in terms of a union + and that union references the same relation on both sides but one si...

EUVD-2025-198499

SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a schema includes the following characteristics: permission defined in terms of a union + and that union references the same relation on both sides but one si...

MAL-2025-190583 Malicious code in node-calculator-fa00 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4262c0c6df0bff5c948bd56a719c0cf2d00aaf9699bb1c4a7367e6054ff72844 The package node-calculator-fa00 was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190562 Malicious code in node-calculator-3e62 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1703fc5c6d064d50b797ea676b0a02186a5cce75afc97191661b8aaa82624543 The package node-calculator-3e62 was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190506 Malicious code in integrator-2829 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6bcecff983d9f430d14498333405f44d090846f460508f71de76679fb2076e9 The package integrator-2829 was found to contain malicious code. Source: ghsa-malware e38f5e4a7250f8d8199f26a59e70750071a304fc729893e38b7074a1cd3ab50...

MAL-2025-190511 Malicious code in signals-embed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83d5dc4270646b6f83ba4c0f5f334ec8a5cedd7b16888c9b51a7b3159ddd32ce The package signals-embed was found to contain malicious code. Source: ghsa-malware 9a80ff00c3aa6ab32518f57107ea588aa2da22e76d6db9823783032b89ca146f...

Malicious code in validator-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83e37a6017e345fd411d1589cfff26c773d65d94f231505eae6ca3a90b448c4a The package validator-node was found to contain malicious code. Source: ghsa-malware d3f7ef04f70e6978a9f771255f136d634d2907c42c7acf71a42c4c93e7e5d333...

EUVD-2025-124923

In the Linux kernel, the following vulnerability has been resolved: xen/events: Return -EEXIST for bound VIRQs Change findvirq to return -EEXIST when a VIRQ is bound to a different CPU than the one passed in. With that, remove the BUGON from bindvirqtoirq to propogate the error upwards. Some VIRQ...

CVE-2025-40160 xen/events: Return -EEXIST for bound VIRQs

In the Linux kernel, the following vulnerability has been resolved: xen/events: Return -EEXIST for bound VIRQs Change findvirq to return -EEXIST when a VIRQ is bound to a different CPU than the one passed in. With that, remove the BUGON from bindvirqtoirq to propogate the error upwards. Some VIRQ...

EUVD-2025-117446

Malicious code in different-lime-muskox npm...

Redis: Redis: Authenticated users can execute LUA scripts as a different user

A code injection vulnerability in Redis Lua scripting where an authenticated user can craft a Lua script to manipulate objects and potentially execute code in another user’s context...

EUVD-2025-74745

Malicious code in differentkoibrown-96 npm...

EUVD-2025-54898

Malicious code in different-coffee-tick npm...

EUVD-2025-54897

Malicious code in different-tomato-bison npm...

EUVD-2025-54896

Malicious code in different-yellow-flamingo npm...

Malicious code in different-tomato-bison (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c37abd6bb661408be04fdaebd76327624cc02fb77124a928bd5d2e10a81d5dbe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...