Malicious code in json-stream-aquarius-cygnus (npm)

Source: amazon-inspector 66572cd8192992ce672eff5d89b4844980b864c0c831f139d85634cab429b063 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

CVE-2026-29975

The lwjson library (version 1.8.1 ) contains an improper input validation vulnerability in its streaming JSON parser, specifically within lwjson_stream.c . The root cause is a logical error where the end-of-string detection logic only checks the immediately preceding character instead of counting...

EUVD-2025-178254

Malicious code in json-stream-aquarius-cygnus npm...

Integer Underflow

Overview Affected versions of this package are vulnerable to Integer Underflow in the GenericReader::ParseNumber function of include/rapidjson/reader.h when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened, this triggers the integer...

MAL-2022-4074 Malicious code in jsonstsream (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad603782f6b86001b6c2dd63872a91ae48f92ea411b205a673b1c04a1c4fe978 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...