GHSA-W3X5-7C4C-66P9 Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

Summary An unauthenticated attacker can pollute the internal state restoreFilePath of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restore" functionality to overwrite critical server configuration files e.g., security.json,...

CVE-2025-66398 Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state restoreFilePath of the server via the /skServer/validateBackup endpoint. This allows the attacker to hijack the administrator's "Restor...

Malicious code in process-daemon-pipe-try-bundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 316ddbb2ffbd1c43021a6c11d374e9f08b52489cfe301ca4161e0c5bb3169d93 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in oscillation-grunt-magellan-dorado (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bd14a9cfb0412ff331fb4db228750a5bd7779ced3a892c4048366316c2786fb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in throw-omega-catch-hot-sanitize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5660c7de16bc52821723bdfd1087c32d214e18bd66d23f006a40f55180fedacd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sudo-reject-mu-proxy-fork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71bd21ebc82601b1500c1ec0b38beaf261822f483579359312b433a31d3a139a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in configstore-quark-sync-callback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30c3b67083ef101f23672989003756131308861e71de005811d2edde2b5f3f8b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in supernova-hyperion-tailwindcss-optimize-css-assets-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f2ef4131d23bf5c2293362acd0d6a0d7dbe8c4af28eb05c78cebe4affa6570c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in global-sadr-polaris-scorpius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2758efa7f7aea7bd87750404b0663d363a1b4c383ad6baac3c731c85ce6b1277 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gemini-ionosphere-superposition-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d9915da48474b9a7fc365caff832585a7c79e69a676a479e6add1449dbf3314 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ceres-petrology-callisto-shelljs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ef236e8eb1b727325a3aa33594675cd45f7056b4eeb66de2ec6f4c3717e7eb0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dagda-ganymede-fornax-ursa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c482e6ef43cf12ba929a25f688df88502f4b2657364bb234a83ecb03729ec0ff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in supercluster-command-betelgeuse-style-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75c4312f9a8f4944f7302c2d84d8f462d661b5c52a2451094345926045d0e847 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in warn-bash-grep-array-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8bc328598631e616c53ed70b1dfd4a169e5b60020465e7e29511eb35b9d538a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in palynology-semantic-release-pulsar-wormhole (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34206c99211389792c4d934032f76e4292094dac40215fc8bc1353575dcefef7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tau-mu-good-beta-kappa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ffc911728d84781a700b5b9e706f5e42e1d50b3a29e8c8141b254da2aa124f4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cryptography-epimetheus-prettier-plugin-markdown-run-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2e74f3563293b19e2d0093030d411190de1d0d6a99c8d37a5480f44a9cffb1b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in command-celeste-resonance-hyperion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3b7daa0dd48aae2de3f1cc7c64f7fa3b63d95577226dcd56b70f089c12ed9b1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in astrochemistry-ionosphere-gravitationalwave-joviology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2119ba76eecde671765855d9947d057698ac00abf631f90c033888f31387b6bc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in subduction-pulsar-yaml-janus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fdcdd77876d0905b0625c6064e91a7bcc7cf4dd76d43162bb3a86d9a6a56da5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...