Malicious code in dewanto-bubur97-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fad4cdc684a7912d996a120f4d6111ccacda41ee58362245cad1e9fe93f7b19 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-59539 Malicious code in wispy_catshark_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29fabb7923f2ceaf9ead3432aad99637a2fea7c3c299fac2d45de294581031cd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cindy-sambalado71-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fd242a7b22e25c70939f0b7cbb9f08a3f3c6af68f8875927e6593af621337ba This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jaja-tahu98-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f8571f1ab653199804f44118e01ae445ab008120cc42a01ecd783bb951ad36c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in grand_quail_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dccbb9879cc3ea85997aae0f0cadc2dc85f4dbc047945cf6572bae750b86d4b5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-56309 Malicious code in fauzi-rendang44-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7aa4515962528e6244692789f43d21edd9efd99bb93484984c2026efffb54dd6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-55535 Malicious code in chubby_primate_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bd85be948e4c231cf25fd3afc63c53d9b4f5693f4b57d387b8c967a13a0f8a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-57535 Malicious code in maman-rujak4-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e89c1df14154326fed98ff353b3842bb39b99846480685bc0d1b9f4424e6cd7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-54907 Malicious code in siska-ikan64-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a5d437de676ea783d2bc8958718d3b93d2efaae1a126297d49da584b95fa5ff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in okta-wajit33-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4df91567556fca3b706811e28fce26e8cb3ba08cf20ca635e3d227fee340dfa4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-53912 Malicious code in okta-brongkos22-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5141dc864079b97cd34039f608f6dc2227cd755f125151bb2c3341d6579a9f9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-54426 Malicious code in putri-sasag26-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 467e583ca282cce23bca64df7e689b52baba09bf4c6ea296968a7263836e9295 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ida-klipo64-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1c3c8d5d9a4e72af8a8608ef456ccf6567d8028ab820edcfe08b75938bb9f20 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hanafi-pecel81-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26da5ad4bd2e39c7172faf67d4de68bdde4cf082e0925b5c4f67f42d9654ef83 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-52611 Malicious code in vera-mendoan11-tititugel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e72f449ec12078a1e8b223f5980248bbd366029cfa003258585b44abe07df09 The package vera-mendoan11-tititugel was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

EUVD-2004-1629

Malware in sbrugna...

EUVD-2023-2680

Malicious code in bioql PyPI...

K000153107: Python tarfile Vulnerabilities CVE-2025-4138, CVE-2025-4330

Security Advisory Description CVE-2025-4138 Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar...

BIT-LIBPYTHON-2025-4330 Extraction filter bypass for linking outside extraction directory

Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall or...

cpython: python: Extraction filter bypass for linking outside extraction directory

A flaw was found in CPython's tarfile module. This vulnerability allows bypassing of extraction filters, enabling symlink traversal outside the intended extraction directory and potential modification of file metadata via malicious tar archives using TarFile.extractall or TarFile.extract with the...