MAL-2025-157377 Malicious code in kamasada-nuyata-budad (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 562964addf165933282cebbe5b8c4e3c5dfab2d49a2aead6d46fd3d985de1420 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-166946 Malicious code in teagood-lokika78 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c108d2966622454fc1ff68a72f671e304e8da64c0c7f0f445afad3334fd97095 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in icha-72 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d216b393b30896cfced549c6d422ccdee83bbabaa52b184c68c38206df12c86 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

BIT-PARSE-2025-64502 Parse Server allows public `explain` queries which may expose sensitive database performance information and schema details

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. The MongoDB explain method provides detailed information about query execution plans, including index usage, collection scanning behavior, and performance metrics. Prior to version 8.5.0, Parse...

Malicious code in betelgeuse-betelgeuse-cassini-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1de30e4d515c90c8d81f0aee56858ae6df343a3a02ddf287cc29b3b20c1380a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-138878 Malicious code in modern-cyan-condor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b19fbb2801752b03d483f9540b0ce95aa3b83204d042ccf9d3da684df398a418 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in umi-gaplek22-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b011c438a08f1d0510f78ea46a6838f41c636cf3fb7c9f88779d41e61f31a198 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rina-lupis36-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95dbe35f759fc5362f33aafd2113bcae278f7ae69d8710b83242c6765e2e4fd4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-131544 Malicious code in yanti-menjes3-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83a461c4c8832f56991dc9fddf32cd733ec0fa0772eb0c05f416a82c068f9e15 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-125795 Malicious code in dewi-otak-otak77-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b01fb9fc81826ac38079d1302c1d8351ed8bfd23f884c0b58b0586a5c1a492ab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

kernel: perf/x86/intel: Fix crash in icl_update_topdown_event()

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix crash in iclupdatetopdownevent The perffuzzer found a hard-lockup crash on a RaptorLake machine: Oops: general protection fault, maybe for address 0xffff89aeceab400: 0000 CPU: 23 UID: 0 PID: 0 Comm: swapper/23...

kernel: perf/x86/intel: Fix crash in icl_update_topdown_event()

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix crash in iclupdatetopdownevent The perffuzzer found a hard-lockup crash on a RaptorLake machine: Oops: general protection fault, maybe for address 0xffff89aeceab400: 0000 CPU: 23 UID: 0 PID: 0 Comm: swapper/23...

MAL-2025-100500 Malicious code in circular_crocodile_brown-100 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a04cace4c91a54bf497d2213b4422c4d78ea7cd3f34e91c6f6a953c03140668 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wicked_gamefowl_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ad9d9defeef6935b20518bf6e2ef05cd8527734f78e2d17c1fc7be1c29c8abb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111222 Malicious code in yanti-tahu32-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a1070cb59372fb876a8e9583e2f4c006953d83ab492d898f2b09efcfe17a247 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-94943 Malicious code in imperial_shrimp_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7d7e416f9f36b3393284653691aabe1b1b8a1ba206e218f88bbe10a8b35137a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kurniawan-asinan7-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63e0cf0e0ed3067ef0b192829968cb18e51c621f8fc6d03382c70b8d765f2f36 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in other_mammal_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6ef80857c1cd84720c1797d89e33a2a9d1fe84d8a7fc69bcbd0a45f41d2e5f5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wibowo-dradag60-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f764a002f335f693701b47bed4aea4b9d34d0ffcd03da7dc14e0437ab06d3292 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-86262 Malicious code in hadianto-tongseng87-apidev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6258aeee2138a686cb547cdf9f3bf4f9967ab0315fd27ce5065ce8ae64643dfd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...