Malicious code in @miptaa02/qnisdayua (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c5cf1f7776fd39f0891df407e039fa188ee73fdb75c6c59c5370e0bfc03e32f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in billa-27 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff68d2aa72828dd25f7fcdec5a44fb67018193ed3384ad58589ad489759dd6c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-162503 Malicious code in nokire-genji17 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddf515f59afe9e6f444a7df859b0a0b5ada5cf6b699be3a599f16af1f5ea9155 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-152734 Malicious code in arif-poke27 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c49014ae20e8d387a5f686a193eb0f5c4addadd3e2d086562e90f51054b02fee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-158747 Malicious code in lookingan-namala36 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d98a59181fee54c076409bf37237347ee3a9a7a8b4ed1f8e7afd3fc7f0df1b77 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-170366 Malicious code in verify-ayca-amalaunioima (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 516feae501a16c9163d6239ae2b6e066f02dec68a47e8d9a00d8b6e667e2fd5d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-169191 Malicious code in trevora-cir136 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6738a19658d6d4884693f35d9a1c466ad08ead5d0e58569d69c01630577092a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CLSA-2025-1762957404 dhcp: Fix of CVE-2022-3094

Rebuild with the latest ELS version of bind to address CVE-2022-3094...

[Webinar] Learn How Leading Security Teams Reduce Attack Surface Exposure with DASR

Every day, security teams face the same problem—too many risks, too many alerts, and not enough time. You fix one issue, and three more show up. It feels like you're always one step behind. But what if there was a smarter way to stay ahead—without adding more work or stress? Join The Hacker News...

EUVD-2025-124972

Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of Apache OpenOffice, Calc spreadsheet containing DDE links to...

CVE-2025-64405

Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of Apache OpenOffice, Calc spreadsheet containing DDE links to...

CVE-2025-64405

Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of Apache OpenOffice, Calc spreadsheet containing DDE links to...

CVE-2025-64405

CVE-2025-64405 affects Apache OpenOffice up to version 4.1.15. The issue is a missing authorization check when handling external links, specifically in Calc spreadsheets with DDE links to external files, which could cause the external contents to be loaded without user prompt. The combined set of...

CVE-2025-64405 Apache OpenOffice: Remote documents loaded without prompt via DDE function

Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of Apache OpenOffice, Calc spreadsheet containing DDE links to...

CVE-2025-64405 Apache OpenOffice: Remote documents loaded without prompt via DDE function

Apache OpenOffice documents can contain links. A missing Authorization vulnerability in Apache OpenOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of Apache OpenOffice, Calc spreadsheet containing DDE links to...

CVE-2025-12637

The Elastic Theme Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a dynamic code generation feature in the processtheme function in all versions up to, and including, 0.0.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

EUVD-2025-117427

Malicious code in dynamic-turquoise-bobolink npm...

Apache OpenOffice 安全漏洞

Apache OpenOffice is an open source office software suite from the American Apache Apache Foundation. A security vulnerability exists in Apache OpenOffice, which stems from improper authorization checking, and can be exploited by remote attackers to automatically load external files containing DD...

Pack-A-Mal: A Malware Analysis Framework for Open-Source Packages

The increasingly sophisticated environment in which attackers operate makes software security an even greater challenge in open-source projects, where malicious packages are prevalent. Static analysis tools, such as Malcontent, are highly useful but are often incapable of dealing with obfuscated...

MAL-2025-132234 Malicious code in bayu-sroto61-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 679a8bcf48388b6d4be0112ce9a2b205cc87cbdf6b72b706fcaf560a67fb03a1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...