From the Shadows to the Headlines: A Decade of State-Sponsored Cyber Leaks

From the Shadows to the Headlines: A Decade of State-Sponsored Cyber Leaks By Ryan Slaney and Emma DeCarli · January 20, 2026 Executive summary The December 2, 2025, publication of a massive leak revealing the inner workings of the IRGC-linked Department 40 a.k.a. APT35, Charming Kitten, and Fres...

EUVD-2025-117365

Malicious code in fresh-salmon-aardwolf npm...

MAL-2025-136807 Malicious code in rudi-tumis25-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f8f6d8b183d524229c55a53ba94046628acf6831b12b287145b47c7932f2362 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-120143 Malicious code in fresh_rook_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff1c0abf961a5672d03d5ec6c2ea73e73b285426eb7c24eb2116b3a1c7b03da5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-91801

Malicious code in freshgrasshopperz3n npm...

EUVD-2025-91799

Malicious code in freshxerinaez3n npm...

EUVD-2025-79197

Malicious code in freshplatypusz3n npm...

EUVD-2025-70335

Malicious code in freshviperz3n npm...

Malicious code in fresh_moth_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2ad7a8f2b1d376ded5ad5819d9b9c1ccd973191ef9f7a3d63062b68f3e0a009 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-63942

Malicious code in freshmothz3n npm...

MAL-2025-94612 Malicious code in fresh_moth_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2ad7a8f2b1d376ded5ad5819d9b9c1ccd973191ef9f7a3d63062b68f3e0a009 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-54218

Malicious code in fresh-copper-sole npm...

Malicious code in fresh-coral-pelican (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 914992543a277b392e6bf5d214a2822aad5a351195d06131cfdb15f7df43a845 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-54217

Malicious code in fresh-coral-pelican npm...

EUVD-2025-54215

Malicious code in fresh-emerald-landfowl npm...

EUVD-2025-54216

Malicious code in fresh-emerald-cephalopod npm...

Malicious code in fresh-emerald-cephalopod (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6b689894aa91509cec5c8c709b62d2d1bf96b509d416bb9ddddbd6c62398bd2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-50151

Malicious code in freshswiftz3n npm...

CVE-2025-11587

The Call Now Button – The 1 Click to Call Button for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the activate function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with...

EUVD-2025-36639

The Call Now Button – The 1 Click to Call Button for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the activate function in all versions up to, and including, 1.5.3. This makes it possible for authenticated attackers, with...