MGASA-2025-0284 Updated perl-Cpanel-JSON-XS packages fix security vulnerability

Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact. CVE-2025-40929...

MGASA-2025-0283 Updated perl-JSON-XS packages fix security vulnerability

JSON::XS before version 4.04 for Perl has an integer buffer overflow causing a segfault when parsing crafted JSON, enabling denial-of-service attacks or other unspecified impact. CVE-2025-40928...

Prototype Pollution

json-schema-editor-visual is vulnerable to Prototype Pollution. The vulnerability is due to insufficient validation of user-supplied input in the setData and deleteData functions, which allows an attacker to supply a crafted payload to inject or delete properties on Object.prototype, potentially...

Malicious code in blitz-materialize-link-lint-staged (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cd6558b44eec2954b20bb99ebb1a7e8e455149631179d6949c5569bd11e1822 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in astrochemistry-ionosphere-gravitationalwave-joviology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2119ba76eecde671765855d9947d057698ac00abf631f90c033888f31387b6bc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in publish-xanthus-cypress-redis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3cddde1a52ce767fadb05cbd31671938c574d95abb54b2c3e13d2a133ea934da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in thermosphere-node-sass-farout-seismology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afedec7a9c064479a8e2564724676591ba3d6387ea85cae80291cab11358ca4a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in index-error-cold-earth-encode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 600c58f15b415a9d7152de753764755c856d4f1b2801557141a9e6a851d05879 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in async-css-minimizer-webpack-plugin-heka-redgiant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33b0f9fca81fca86a14b33c7bfac2d72987607fea039001a9568eff34c879063 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in toml-superflare-rollup-algol (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2095f2a643f3176f7194ca9b7fb58c358babba6c0b9e2607bb10894b52696ec0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in orbit-publish-dynamo-helmet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70cea22e2995495ae31f048c41734ea03860fac70bf7d26e7ae19a80dde208ee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gatsby-await-palynology-version (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d70de77bf70ec7002d967b917e7a999162d78c5472219f6ee6d07e7dd73baa80 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rollup-plugin-firebase-geochronology-version (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52e0281ce62a32de1725eb603807b7890d11f596aecd42507b277a31497e925c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in promise-interpret-cache-final-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9605759b1020adeb5ec89f5a9efb1c8e482a5658943df0515f8cd42b73f4425 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phenomic-gemini-adonis-neptune (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70e473e63486e2e3fb28b1c74b916ee10e38ac8e36cf418dc8213946bf8a4a0b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in native-blackhole-parcel-node-sass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a471cc517289478a545c2d4f578f4a0270138b69edff1c911bc1f622c60c9c4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in convict-writable-webpack-cosmogenic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d97564ab9fc4db43f4230b9d93ccc412d62ff1b73b25e6ee7eeca8c3f4298df7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in css-loader-castor-supervisor-elara (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 193b52bbac9dd8c437627cdd8702135559f279b67db8494364cbc1d7a07bfec9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in buffer-package-bionics-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1fd405157c2817e145d01f5a76694010a00124749169424ea157e463f04adb5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cosmogenic-astroinformatics-mesosphere-soap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51f5567535a8c7e5a16a20da17662eb0990505e3a08147a910886879f3674c79 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...