MAL-2025-147942 Malicious code in sirius-config-levels-umbriel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dda37d8300529894192d4550cbebc8d45b72b09020b658596425e04f458a7a61 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143158 Malicious code in halley-ophiuchus-markdownlint-figures (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3607655a9434cf502c2fa60318a5328e80964eb1e771161aa48914888bf2f2f8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rigel-less-lint-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0250b17d1e824b9261142e2ef10bcd989d933f1fe55d49cfd55a9fc7ff406bc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aurora-yildun-karma-xanadu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 002463a9ef23a3781a6864d5ad3a340c5c545b7720c5f79a22a9477e198d67d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145758 Malicious code in oberon-xanthus-slides-farout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 564241ace50ae8cfeaf5ab8b4c943999f20cb66edf29bb7a2025370de13b0d74 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139034 Malicious code in spotty-green-mouse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 235b2d0ae78ab8ad8a86f5f1b00a821d6d7696dfa134f0f972d25217e09c3d52 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

UBUNTU-CVE-2025-40111

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix Use-after-free in validation Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmwexecbufprocess. All nodes are expected to be cleared in...

Malicious code in yanti-sambel5-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85e9956507a40549a3c75cb5f36fe2db1549da2fd490887f26af0678122ce85f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in okta-oblok90-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b829043a5167c11e06244b4be6c9e9f7623a79cb727d7013fd030ece2e9423c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in molecular_gull_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f4be6019ce947a4d607e0a10422e4df8db65d943752b55a9d75165d88ef3785 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138067 Malicious code in wibowo-semur49-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c97c1c70d0ab103dec26c464d864831e2a52d19b800f5e59764096d77111b54e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-49145

Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, a user that has enough rights to create webhooks mostly administrators can drop the database. This is fixed in iTop 2.7.13 and 3.2.2 by verifying callback signature...

Malicious code in wawan-otak-otak91-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60b9b364f9170f6e7ad4c970bddd383737274ea8cc161a29dae496cbbade3644 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-129298 Malicious code in partial_hippopotamus_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 081938676ae03c13032d2e58102d50a5eef5722315c0ae462b00d0f3df874709 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-130175 Malicious code in sinta-oblok88-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e29442b28315411659def6d9824823379881cb491a13e34a185edcb828bb1fc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in arif-kue20-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48d2acd879eb10d3c4f417b4c189fe3aabf073a001c53af8e81e79097facff84 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in delighted_tortoise_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05e64aa44c81c7aea6959ea516d8a6b0dfecbda4c39451e80cfa2f533c4e1554 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-127583 Malicious code in jaja-gado-gado78-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 401d6c6ed4c4a57c6c7a49fd0d17f55c9dfe83881c7496c78bab03baa45c0f93 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-130823 Malicious code in umi-lumpur62-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2aa6bb0dd9ca0739e89f218d77faafc09fb1365c56d0f9219e3818a29a4730bc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tiara-liwet84-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a92957d5462d6f81d962712eac83d953f095ac7a406d6d65278c3d194a2241a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...