MAL-2025-67275 Malicious code in colonial-amethyst-galliform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1da3b9a92f1e02ba419ae9ac52036bd8a6cfc5c739f96f22edf0f5eb1564b820 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-68949 Malicious code in intensive-red-vicuna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d1c7124029bb86dff596bfaf77c9a7161e5bba66c80d666ecedb6ee4b8d516b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-65761 Malicious code in umi-kue35-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de621d60d98213d90c3190886f21e916031ca0f88d1c04a8035ff24ea69c0fb6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-61287 Malicious code in silly_asp_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acff558db8c8b049fc844e0c44e806f53af7cd82bc64d9a6ec866ecf77c54b5e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-61165 Malicious code in relative_fowl_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 393d7c621958a2449948715c4da4f917b377e78baca6baf84d6e70e8cfb70d94 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in scornful_duck_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0e20890f97ee0a4a48cbeb09e033b2f0445aa3c00186b5bd87352c84b9de7d9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tragic_heron_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bddf45b94f0f717b7456ae6f580f5eea65e7e21c20a0fca3482cb43ef34fbd6e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-55784 Malicious code in dewanto-kue89-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 678eb133e3a8046d76dd4fbe1caabb6263e06d8dd9da7ac4818c7270d5063b76 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in galih-mendut29-crottsekebon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 082c39c084d351bd38fb4e3f3ad35cfa2b8f61497e0a1f33e9684cdcfc99d55e The package galih-mendut29-crottsekebon was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign tha...

EUVD-2015-6970

Malware in sbrugna...

CVE-2025-10894 Nx: nx/devkit: malicious versions of nx and plugins published to npm

Malicious code was inserted into the Nx build system package and several related plugins. The tampered package was published to the npm software registry, via a supply-chain attack. Affected versions contain code that scans the file system, collects credentials, and posts them to GitHub as a repo...

CVE-2025-59336 Relative Path Traversal in Luanox

Luanox is a module host for Lua packages. Prior to 0.1.1, a file traversal vulnerability can cause potential denial of service by overwriting Phoenix runtime files. Package names like ../../package are not properly filtered and pass the validity check of the rockspec verification system. This...

PT-2025-37918

Name of the Vulnerable Software and Affected Versions: Sparkle versions prior to 2.7.2 Description: The Sparkle framework’s Autoupdate tool lacks authentication for connecting clients. This allows a local, unprivileged attacker to request the installation of a crafted malicious PKG file, leading ...

Malicious code in python-biannce (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx d8240e2672f5130ce25db78c03e0b75bb8908b101ab4b40844ab155cdc7a122f Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

CVE-2022-40178

A vulnerability has been identified in Desigo PXM30-1 All versions V02.20.126.11-41, Desigo PXM30.E All versions V02.20.126.11-41, Desigo PXM40-1 All versions V02.20.126.11-41, Desigo PXM40.E All versions V02.20.126.11-41, Desigo PXM50-1 All versions V02.20.126.11-41, Desigo PXM50.E All versions...