MAL-2025-51450 Malicious code in citra-sate14-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb62cc5423ff5d9078179f29746ea010686b11fb23567ff440fd15f6c887a761 The package citra-sate14-ruro was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

MAL-2025-51370 Malicious code in cindy-pecel35-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a10c196f0515052e6f06873925a03248bc213f7828937ca624020f0b30ab0ac The package cindy-pecel35-miaww was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that floode...

Malicious code in citra-papeda89-pore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd6aff7e511ac2fd578ecae0f15628256fbc81bbb3de4f884c943898ec8c948b The package citra-papeda89-pore was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that floode...

MAL-2025-50574 Malicious code in udin-gulai5-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bcdf59715e06ab9c5382eab57e07e802ce9a4d6f044b6dc8401e439d754c3b3 The package udin-gulai5-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

PhantomRaven Malware Found in 126 npm Packages Stealing GitHub Tokens From Devs

Cybersecurity researchers have uncovered yet another active software supply chain attack campaign targeting the npm registry with over 100 malicious packages that can steal authentication tokens, CI/CD secrets, and GitHub credentials from developers' machines. The campaign has been codenamed...

10 npm Packages Caught Stealing Developer Credentials on Windows, macOS, and Linux

Cybersecurity researchers have discovered a set of 10 malicious npm packages that are designed to deliver an information stealer targeting Windows, Linux, and macOS systems. "The malware uses four layers of obfuscation to hide its payload, displays a fake CAPTCHA to appear legitimate, fingerprint...

MAL-2025-48835 Malicious code in eithernet (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2025-59037

DuckDB is an analytical in-process SQL database management system. On 08 September 2025, the DuckDB distribution for Node.js on npm was compromised with malware along with several other packages. An attacker published new versions of four of DuckDB's packages that included malicious code to...

Fedora: Security Advisory (FEDORA-2025-2936dece0e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CouchAuth 注入漏洞

CouchAuth is a Perfood open source authentication API. An injection vulnerability exists in CouchAuth 0.21.2 and earlier versions, which stems from the presence of host header injection in NPM packages, allowing an attacker to trigger an SSTI via a specially crafted request to disclose informatio...

Malicious code in assets-graph (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx e513e7556846ca62fa4d27646eef928d55f2c2954ce9caa51dd63643e2adf445 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

Malicious code in ipsecurity (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx a051635703d3a602e1b05da35aa26561b2f211a4625fe23054dd6d8f6b44757b Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

Malicious code in esqccpongcpu (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx c15d17f192fef96f3398bc91fe19bdcbcca1aa284532b9c0db068eefc1160732 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in libguigrandmc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 6aecdbe6b089ffe59ba97add73503b78ab4c6dc432a5b733ed03687c146effbf EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in tphydratoolsplit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 0b83ac2b575decdf8cd7ea3be0d7a2c8073ceb3b113d3a756fcb0b189605a718 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in esqstudyrepull (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 009e3afe0678f4ddccc2f22c8f54172f2d18e1223738609678eb4743ef44ca1d EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in esqpywlgtbnvidia (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 191b968fc6ef6972cdbabd8267338948b672db4a977286eafb77fa1563b13a3f EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in selfcvinfoad (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 934ef50eb7830e1355e375cbb3e865e916602091e5eb92946e6980facdcaa45f EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in tpintelpullcpu (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx aa5aa0d7db3d4fbdeb8813876a47fb05270e4b0d1e3b83b994a2caf8be6b0aa2 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in esqproofpongint (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx d4705c856105aac2f1df126988951f8680127cf4798413af80d75dd19c04ae81 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...