CVE-2026-64836

ICEcoder versions through 8.1 contain a path traversal vulnerability in the file-control endpoint due to a logic error in the document-root confinement check. The File::check validation function compares realpath to boolean true, which never succeeds, allowing authenticated attackers to submit...

net/textproto: golang: Golang net/textproto: Misleading error messages via input injection

A flaw was found in the net/textproto package in Golang. When functions in this package return errors, they include their input as part of the error message. An attacker could exploit this by injecting misleading content into these error messages, which are then printed or logged. This could lead...

Malicious code in error-validate-refactor-byte-lambda (npm)

Source: amazon-inspector 6e7990422b33800950f82b858c49bc8d9140dbd49c020770a8373607ea132679 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in error-root-long-sigma-interpret (npm)

Source: amazon-inspector db058b9bd6e68f4c1d3980b659c41874e6030029b47dde99d2f248f0cc0ddb43 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in error-simple-view-public-float (npm)

Source: amazon-inspector e47bccb9c5e1c28d4bef78850255f9937e5e7874e0067f26188a121d249b24f1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in error-signal-minify-zero-index (npm)

Source: amazon-inspector 9de97ad293aa756831d0293ba26e692cc4a59e7f7ba970803c8b51ec783cb420 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in error-loggerjs (npm)

The package error-loggerjs was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in error-stack-parsersasasa (npm)

Source: ossf-package-analysis 95ee2924307d088b5e7509bfa51de2136a5611527d0de92d5ea4020f7ba0edf0 The OpenSSF Package Analysis project identified 'error-stack-parsersasasa' @ 1.2.7 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with maliciou...

Malicious code in error-sun-eta-assert-error (npm)

The package error-sun-eta-assert-error was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in error-byte-earth-cache-tau (npm)

The package error-byte-earth-cache-tau was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in error-fast-class-visualize-new (npm)

Source: amazon-inspector 29ab6287114c993123a1c774b449f01bfe2dc45a5f5b310517d84dc224ebd170 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in error-analysis (npm)

The package error-analysis was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in error-float-report-resolve-sigma (npm)

The package error-float-report-resolve-sigma was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in error-alpha-sanitize-sanitize-daemon (npm)

Source: amazon-inspector 1c05a938b12a3f015427b82e19d6772e1ff1d896c7088a090df2f14ff244015e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in error-bash-monitor-stack-decode (npm)

Source: amazon-inspector 9a40039f7e0254dac8bfdd5141586a28742202eadc46a657b45eb9ffcd727ee2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in error-module (npm)

The package error-module was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in error-error-authorize-phi-mock (npm)

Source: amazon-inspector b340179d411fda452870d0f9f487b221dfa2c4ebd9f2f2e93457306569405e42 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in error-iota-file-quick-shell (npm)

The package error-iota-file-quick-shell was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in epsilon-scale-error-debug-container (npm)

The package epsilon-scale-error-debug-container was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in epic-js-error-reporting (npm)

Source: amazon-inspector 2383bd02db4d187842b44f1880e2a0d88e02f54e8dff17c720e4f1f00138c520 The package epic-js-error-reporting was found to contain malicious code. --- Credit: OpenSSF source...