bitcode (>=0.2.0 <=0.5.1), bitcode_lightyear_patch (>=0.4.0 <=0.5.1) +25 more potentially affected by CVE-2026-32829 via lz4_flex (=0.10.0)

lz4flex CARGO version =0.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on lz4flex and may be impacted: - bitcode =0.2.0, =0.4.0, =0.16.0, =3.0.0, =8.0.0, =0.1.1, =0.1.0, =0.1.0, =0.25.0, =0.5.0, =4.0.1, =4.4.2 and more Source cves: CVE-2026-32829...

MAL-2025-146641 Malicious code in promise-graphql-start-superagent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2289446017d83cf85ed806fb6e736a6f69f9e8d4e760a2daf3d238881af564bd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-128907 Malicious code in nina-getuk12-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ae99d07120e93336f528386d100d2613de4937919a7276fc87c25cc51253d07 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in likely_gamefowl_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 244b20979aa8afe1e8eeaaf6601d5a73d6a8be90561f4e977caffe1682c8e8ff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eka-kue10-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47a330b3541b1f257622058b7ffaf9e94373c03c4680af91b835588b5837648d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-100684 Malicious code in coloured_cheetah_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb59d53f9cc32c19c6fc0506faf401540efe863ede262a6d12211b50bcb8d02f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111157 Malicious code in yanti-bubur95-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 132f4d1e68c06e014695ab3723465fcbb1e547c0721d40ae18350251a518f467 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lina-rujak45-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1f5c1c1aabaf6ca9a7a058aa928ebf58de932a25f194e148878f929ae90f593 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

3way (>=1.2.0 <=1.5.0.42), a-texam (=1.1.0) +445 more potentially affected by unknown CVE via scapy (>=2.2.0.dev0 <=2.7.0)

scapy PYPI version =2.2.0.dev0, =1.2.0, =0.1.0, =1.0.0, =1.0.0, =1.1.0, =0.1.13, =0.1.4, =0.1.0, =0.1.0, =0.2.0, =0.3.10 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-SCAPY-13669870...

ace-step (=0.1.0), agent-memory-jojo (=0.1.3) +163 more potentially affected by CVE-2025-3263 via transformers (>=4.49.0 <=4.50.3)

transformers PYPI version =4.49.0, =3.2.0, =2.2.0, =0.0.5, =2026.3.1, =0.1.0, =1.2.1b20250404, =1.2.1b20250404, =1.2.1b20250404, =0.1.2, =0.1.8 - azureml-metrics =0.0.25.post1 and more Source cves: CVE-2025-3263 Source advisory: SNYK:PYTHON-TRANSFORMERS-10658535...

ac-solver (=0.1.0), adversarial-insight-ml (=0.1.0) +538 more potentially affected by CVE-2025-2999 via torch (>=2.0.0 <=2.0.1)

torch PYPI version =2.0.0, =0.0.2, =1.2.3, =0.2.2, =0.0.2, =0.0.0, =1.9.0, =0.0.3, =0.8.0, =0.1.0, =0.0.1, =1.9.0, =1.17.1 - aisee =0.1.0 and more Source cves: CVE-2025-2999 Source advisory: SNYK:PYTHON-TORCH-10332645...

auto-wasi (=0.1.0), candid-extractor (>=0.1.0 <=0.1.2) +99 more potentially affected by CVE-2022-39393 via wasmtime (>=0.10.0 <=12.0.2)

wasmtime CARGO version =0.10.0, =0.1.0, =0.1.0, =0.1.1, =0.5.3-0, =0.4.0, =0.4.0, =0.0.0, =0.5.0, =0.0.1-alpha, =0.40.1, =0.45.0, =0.1.0, =0.3.0 - inkpad-executor =0.1.0 and more Source cves: CVE-2022-39393 Source advisory: OSV:RUSTSEC-2022-0075...

auto-wasi (=0.1.0), candid-extractor (>=0.1.0 <=0.1.2) +99 more potentially affected by CVE-2022-39394 via wasmtime (>=0.10.0 <=12.0.2)

wasmtime CARGO version =0.10.0, =0.1.0, =0.1.0, =0.1.1, =0.5.3-0, =0.4.0, =0.4.0, =0.0.0, =0.5.0, =0.0.1-alpha, =0.40.1, =0.45.0, =0.1.0, =0.3.0 - inkpad-executor =0.1.0 and more Source cves: CVE-2022-39394 Source advisory: OSV:RUSTSEC-2022-0097...

Software Supply Chain Attacks: From Formjacking to Third Party Code Changes

2020 wasn’t the first year in which software supply chain attacks caused major damage, but it certainly brought them to the general public. Much has been said about the headline-grabbing nation state examples, but there is a wide spectrum of these attacks and some are commoditized. Protecting...

@forgerock/openam-agent-cache-memcached (=2.0.0), @mapbox/tilelive-memcached (=1.0.1) +74 more potentially affected by CVE-2018-3767 via memjs (>=0.10.2 <=0.9.1)

memjs NPM version =0.10.2, =1.0.0, =0.0.0, =0.12.1, =0.0.1, =0.8.0, =0.1.0, =1.1.0, =1.1.1 and more Source cves: CVE-2018-3767 Source advisory: OSV:GHSA-CX8M-8XMX-Q8V3...