6198 matches found
MAL-2025-148344 Malicious code in style-loader-wolf-elara-nconf (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 797680a710ec1984e98fab2b185ba656f47c264af598ba861fce43bd6dd7b5bc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-147682 Malicious code in sass-loader-quasar-transport-upgrade (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f20c0ab48c9f324f56d5d61c41b6df53b2f9637aa4732f761ac74b9eda2b6ba This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-144323 Malicious code in less-loader-karma-scorpius-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b1a366b01f8a30156d34848cdfcdfa4add09f451e05d17956ac202817a863f6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-142862 Malicious code in geckodriver-css-loader-transform-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f64f78d7d77f3e696991adcac5717ada6171d328e0dc9af25c717170d0a10828 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-146397 Malicious code in postcss-loader-halley-middleware-xanadu (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3076fe57c760cf3d4422180906de48b72abea4f1b53c7e7e850d04ae24e820db This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-148520 Malicious code in terser-flare-css-loader-pipe (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 691bda64b8884a4f1061ba8baa4801188477d843430b4571326d701603b5b08c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-139759 Malicious code in auth0-style-loader-polaris-gridsome (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 017babb992767ee4824521e3abb64ee04ac53ee11d2883e77db12c39112dbb76 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-145019 Malicious code in miranda-ariel-metalsmith-css-loader (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0edfbaf3006b6027e406e19e8a4d6215add69e23c09a4540decae8c630303be8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-146343 Malicious code in polaris-galaxy-dione-css-loader (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fe89b18978b330a37b7d1dbdf56eadbf5e873ddc9b39a4676a80187c71923c6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-146157 Malicious code in phoebe-lynx-less-loader-passport (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06b6e9c51d8df792487558370f33d75af46a24800c3767d05e9a4ab2115d7011 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-111791
Malicious code in less-loader-jekyll-deneb-luna npm...
MAL-2025-146179 Malicious code in phoebe-sass-loader-async-europa (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8090a8462ed301278b5f4858f19d9f7be19c3e0895b1da7bc4e5a099f51641a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-141306 Malicious code in css-loader-kaus-prettier-plugin-markdown-schema (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c520d0a4a8fead49be08d7a48aa69a9c1ca93479e5758acbfae5f2819a1c65ac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-146405 Malicious code in postcss-loader-pegasus-registry-chai (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da724633e0b2627cc47e764d76ffc267a948d6191d9f6aa6ee8f491a9fc1e9ca This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-141505 Malicious code in deimos-sass-loader-quark-dotenv (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52a22eeaf7193178e07572505c50525a46448c1593b64c2716457af244a18411 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Unbreakable Enterprise kernel security update
5.4.17-2136.349.3.1 - i40e: add validation for ringlen param Lukasz Czapnik Orabug: 38604171 CVE-2025-39973 - i40e: increase max descriptors for XL710 Justin Bronder Orabug: 38604171 CVE-2025-39973 5.4.17-2136.349.3 - Revert 'net/mlx5e: Update and set Xon/Xoff upon MTU set' Jakub Kicinski Orabug:...
EUVD-2025-38331
Insecure Deserialization pickle in pdfminer.six CMap Loader — Local Privesc...
GHSA-F83H-GHPP-7WCC Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc
🚀 Overview This report demonstrates a real-world privilege escalation vulnerability in pdfminer.six due to unsafe usage of Python's pickle module for CMap file loading. It shows how a low-privileged user can gain root access or escalate to any service account by exploiting insecure deserializatio...
Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc
🚀 Overview This report demonstrates a real-world privilege escalation vulnerability in pdfminer.six due to unsafe usage of Python's pickle module for CMap file loading. It shows how a low-privileged user can gain root access or escalate to any service account by exploiting insecure deserializatio...