Malicious code in upgrade-spawn-server-inquirer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a6ae84aa5b7fe85307aa839241cc7ad1bc03413134bad3133d229dd5cb63412 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-137801 Malicious code in vida-tempe52-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 475394238a040702da1ef1c899c4ee3ae110cff86a579a1b80a37fd471fd2163 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-135468 Malicious code in maman-pecel67-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67edbb42548375e20f04504c3104a0b149ff8e822178df96f6b1153095e9d9eb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eko-rendang95-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4f43d9c2718e65663d25c2c078518717b296a0dda5e9e0d5c6b9e90ce56a2bc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-124218 Malicious code in wawan-gorengan21-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c93aed90e90becb0e8d93c5165065271c3520c947ae946dbcb796812433922bd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-108892 Malicious code in social_porcupine_0xrequest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37d1b549204f1187a540a2390178794846e8c3dd51dff3d29401ad4fd8f35c24 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in heavy_bobolink_dumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0dbe85c01db4fddecfc3f63b96e127fd70abe4f6951f47ee4c68d0796e0c7b6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-4645

An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a...

Malicious code in gleaming_crow_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 505f911c5c2b2567a211ac4622b2b5ef94396b4b0132607297b5e59886e821e2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-78013 Malicious code in exotic_anaconda_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35ee9ee417e71079d9f29a4706a02a21a05d42153acb4db6e63b7b8672b811b4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-73093 Malicious code in gilang-miebogor2-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36cbc481b3c7d3c3a7763093aec7de3c40b3f5b247233527a93d927a38d0f897 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-63617 Malicious code in jaja-esdoger7-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 557a882d069bf5ed48771b9a9fc6ec58d8b37142dac62993c5693f7c18fd1115 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-66105 Malicious code in wawan-mangga74-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b425f658b206cd98d3adf2d3e76ac8c030d9af6f58e73c8ccd46792e6deae01b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-13016

Incorrect boundary conditions in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5...

CVE-2025-12437

Use after free in PageInfo in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-12430

Object lifecycle issue in Media in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: High...

CVE-2025-12436

Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. Chromium security severity: Medium...

CVE-2025-12439

Inappropriate implementation in App-Bound Encryption in Google Chrome on Windows prior to 142.0.7444.59 allowed a local attacker to obtain potentially sensitive information from process memory via a malicious file. Chromium security severity: Medium...

CVE-2025-12431

Inappropriate implementation in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. Chromium security severity: High...

CVE-2025-12447

Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...