MAL-2025-155630 Malicious code in hafiz-poke25 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a3de0c0c7d6d42d1a1e8f128a27ce48a080df49bbd0352e751fcbb881e99c30 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-157715 Malicious code in kuinsu-lki-kopannataiabumi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0b3149c9e60392ce7dff8edc05be73c1eaf892a9d9c586d1aba4fe14da4b32d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-163142 Malicious code in nokire-namiresan85 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b4f1c0298cf8e84abc14cdc1334098c307ac551e8c995442ba58167bc61a9c6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in huda-poke48 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 242dbaff5902db0aa57180d1ec61710eb9074cbc4103fee0d1d486f24d41e0b3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-144072

Malicious code in nabuf-ogaf-doifaogako npm...

Malicious code in ican-poke32 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b952c7fdeafde2b724e4252c55e9621d07b3c70937952ac2d38e4b7c4d72194 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aciyua-idusut-dajuar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fd25f2fa435079c5f030b43f08bf139f8508efabb2a3f4fb503469db4960647 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Security Bulletin: IBM QRadar SIEM is affected by improper storage of credentials in configuration files

Summary IBM QRadar SIEM is affected by improper storage of credentials in configuration files in source control. IBM has addressed the issue in the latest update. Vulnerability Details CVEID:CVE-2025-33119 DESCRIPTION: IBM QRadar SIEM stores user credentials in configuration files in source contr...

WordPress Passster plugin <= 4.2.19 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Que Thanh Tuan - Blue Rock in WordPress Plugin Passster versions = 4.2.19...

CVE-2025-40171

Technical details for CVE-2025-40171 are not provided in the supplied connected documents. Monitor for vendor advisories for affected products, versions, impact, and fixes.

xorg-x11-server-Xwayland security update

An update is available for xorg-x11-server-Xwayland. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Xwayland is an X server for running X clients under Wayland...

MAL-2025-147964 Malicious code in sirius-optimize-css-assets-webpack-plugin-auth-loglevel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8382ca6a8e541e292bab6da68d987f95fc70200f8bf3bcd136415f68699d27d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-112812

Malicious code in hermes-apex-css-minimizer-webpack-plugin-phoebe npm...

MAL-2025-143024 Malicious code in gravity-flare-async-foundation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afaee9c4dea8100f153b287b329c31392a468c2d17a4394f167daf28eee72e7b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sync-sedna-titan-neptune (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f21b6da689a26b9fc953c4b51dcbd64b26126504fefc42aca279aa0cee6f1b4d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-120233

Malicious code in xerxes-astro-axios-rocket npm...

MAL-2025-149357 Malicious code in webdriver-mocha-miranda-virgo-hydra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8823687b1a4ad4db6d07e11c07334da46f31bbe82d7d061ccf946caafb16fd1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141584 Malicious code in dependencies-sequelize-titan-antares (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09049d1fe55b090643d923e84f8ce0326ae4a3c84a661975aa03b0a5573a0cbd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

WordPress Alt Text Generator AI plugin <= 1.8.3 - Missing Authorization to Authenticated (Subscriber+) API Key Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ API Key Deletion vulnerability discovered by Legion Hunter in WordPress Plugin Alt Text Generator AI versions = 1.8.3...

WordPress Asgaros Forum plugin <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update vulnerability

Cross-Site Request Forgery to Subscription Settings Update vulnerability discovered by Brian Mungai in WordPress Plugin Asgaros Forum versions = 3.2.1...