CVE-2025-67780: Missing Authentication for Critical Function

SpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 e.g., on Mini1prod2 allow administrative actions via unauthenticated LAN gRPC requests, aka MARMALADE 2. The cross-origin policy can be bypassed by omitting a Referer header. In some cases, an attacker's ability to read tilt, rotation,...

EUVD-2025-105080

Malicious code in geographicalchipmunkz3n npm...

Malicious code in geographical_mite_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5458b8c115888fa0d3625ad30c78932067abc11e0cfc2022528224fbcb436017 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-74613

Malicious code in geographicalroosterteal-71 npm...

MAL-2025-111939 Malicious code in geographical_rooster_teal-71 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 086c37c7850b39bca204afac18947058026863687b7e0699240e6296525d4f79 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in geographical_dingo-apptea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f470cf421c877123d73c715e0ab3830c3dea923f4daf98dee6304582808360bd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-76768

Malicious code in geographicaldingo-apptea npm...

EUVD-2025-76767

Malicious code in geographicalroadrunner-appteadev npm...

EUVD-2025-76769

Malicious code in geographicalapereplicateautomation npm...

EUVD-2025-81809

Malicious code in geographicaljunglefowl0xrequest npm...

Malicious code in geographical-red-toad (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a5c1ab4249f9faa2dab7fffceb07ffefa5ba9eec7e498452930086c58d58649 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-54134

Malicious code in geographical-maroon-tern npm...

EUVD-2025-54135

Malicious code in geographical-fuchsia-booby npm...

EUVD-2025-54133

Malicious code in geographical-red-toad npm...

EUVD-2025-54132

Malicious code in geographical-scarlet-gull npm...

MAL-2025-68516 Malicious code in geographical-red-toad (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a5c1ab4249f9faa2dab7fffceb07ffefa5ba9eec7e498452930086c58d58649 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in geographical_marlin_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cd85a043a06298e0aa197ea9be50d68043cec5298e2b79615b6589c8281684d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-50122

Malicious code in geographicalmarlinz3n npm...

Researchers Detail Bitter APT's Evolving Tactics as Its Geographic Scope Expands

The threat actor known as Bitter has been assessed to be a state-backed hacking group that's tasked with gathering intelligence that aligns with the interests of the Indian government. That's according to new findings jointly published by Proofpoint and Threatray in an exhaustive two-part analysi...

TP-Link Router Botnet

There is a new botnet that is infecting TP-Link routers: The botnet can lead to command injection which then makes remote code execution RCE possible so that the malware can spread itself across the internet automatically. This high severity security flaw tracked as CVE-2023-1389 has also been us...