MAL-2025-163102 Malicious code in nokire-namiresan49 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ecd7d8d67fa23b40e6b99cb2aad7cc26db6abaa73be0924c82324c2a074bae6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-160658 Malicious code in modirai-igmao-jai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 267474a07d86b3e799350d115e72aed60e2d2bad92ba4d75e0a55e4776243add This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-160506 Malicious code in miracle-dok-uai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b0a3b59cfe477b7442f59638f6561be8825a421a181a4af7995572c9ad00ba0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-168097 Malicious code in tealove-aruma40 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5fd5e641aa2a5258858d186388e568713d2887349a5dd9dc0197eace5bca64d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-160729 Malicious code in modirai-imgono-jinmu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74b8187970bdda132097a44fcf7e7ccdae3df31c75db282b9662f64efbad0131 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-151040 Malicious code in @miptaa02/xdhdj (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1097afcb25def8e5b7d06e7637f5ba8ae7777000c6bfa7c8aec9ebd1465f73fb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

kernel: iomap: iomap: fix memory corruption when recording errors during writeback

In the Linux kernel, the following vulnerability has been resolved: iomap: iomap: fix memory corruption when recording errors during writeback Every now and then I see this crash on arm64: Unable to handle kernel NULL pointer dereference at virtual address 00000000000000f8 Buffer I/O error on dev...

kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy

In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfsmdtdestroy In allocinode, inodeinitalways could return -ENOMEM if securityinodealloc fails, which causes inode-iprivate uninitialized. Then nilfsismetadatafileinode returns true and nilfsfreeinode...

EUVD-2025-124952

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix peer lookup in ath12kdpmonrxdelivermsdu In ath12kdpmonrxdelivermsdu, peer lookup fails because rxcb-peerid is not updated with a valid value. This is expected in monitor mode, where RX frames bypass the regular ...

kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy

In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfsmdtdestroy In allocinode, inodeinitalways could return -ENOMEM if securityinodealloc fails, which causes inode-iprivate uninitialized. Then nilfsismetadatafileinode returns true and nilfsfreeinode...

UBUNTU-CVE-2025-40131

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix peer lookup in ath12kdpmonrxdelivermsdu In ath12kdpmonrxdelivermsdu, peer lookup fails because rxcb-peerid is not updated with a valid value. This is expected in monitor mode, where RX frames bypass the regular ...

CVE-2025-40131 wifi: ath12k: Fix peer lookup in ath12k_dp_mon_rx_deliver_msdu()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix peer lookup in ath12kdpmonrxdelivermsdu In ath12kdpmonrxdelivermsdu, peer lookup fails because rxcb-peerid is not updated with a valid value. This is expected in monitor mode, where RX frames bypass the regular ...

CVE-2025-40119 ext4: fix potential null deref in ext4_mb_init()

In the Linux kernel, the following vulnerability has been resolved: ext4: fix potential null deref in ext4mbinit In ext4mbinit, ext4mbavgfragmentsizedestroy may be called when sbi-smbavgfragmentsize remains uninitialized e.g., if groupinfo slab cache allocation fails. Since...

kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy

In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfsmdtdestroy In allocinode, inodeinitalways could return -ENOMEM if securityinodealloc fails, which causes inode-iprivate uninitialized. Then nilfsismetadatafileinode returns true and nilfsfreeinode...

kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy

In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfsmdtdestroy In allocinode, inodeinitalways could return -ENOMEM if securityinodealloc fails, which causes inode-iprivate uninitialized. Then nilfsismetadatafileinode returns true and nilfsfreeinode...

Malicious code in upgrade-release-it-delphinus-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9723dac1015b770186c13a25fd43bc6378a218746a96c2afb664e0faf6941f72 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in inquirer-tailwindcss-sqlite-sirius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e7d2c4df32fc567b689d9a1bbf8975994a17c7e260c5fa4dcff587b6680ef6e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in neptune-fornax-miranda-mongodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25e546f80e3630052ab9e9536f8ee2827f28cb7a9bfcdf8362f0330a310ed9b4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phoebe-webdriver-mocha-dotenv-safe-nebula (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4741cab512695c1c5578f08e6536747101c2e0fff2151fbfe86c9ec962f7f78 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in loop-virgo-impulse-magellan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6f7baa439a7ef55154ee9b9254ab2728fa7346ccf937a84ab806d616b5b3e7f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...