MAL-2025-187320 Malicious code in helios-webdriver-mocha-superposition-phylogenetics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7fa52991d1dbcd2f6889af5503b80d384df7b867c03de23959b38644f8ce0cc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-171534 Malicious code in maevekelly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 376373d830b5b9c73f83e3fc78016edcc3c8c40456c4c8426452dc89a5af5a6a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rita-95 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f328c67bca3b3029d0f1cafeeafdb11f65ad7a12284137ac6c3b21c41ec0bbd4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-81367 Malicious code in siska-bakso49-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5153233312e18bea24571fd08683b8cafdc893b19d379f1b647e68dbd730540d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2012-6119

Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests...

PT-2013-1904

Name of the Vulnerable Software and Affected Versions Candlepin versions prior to 0.7.24 Red Hat Subscription Asset Manager versions prior to 1.2.1 Description The issue is related to the improper checking of manifest signatures, allowing local users to modify manifests. Recommendations For...

Candlepin: Re-enable manifest signature checking

Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests...