Malicious code in rino-poke88 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c252c09b1b7184b871c5d1e10921422c31764ccc36436f88172454b3679c32f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in madan-poke43 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 095401287eac283af5876663379735f7f55ab204635c0e5dec794aaa0b8188b4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jimmy-poke38 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab960ca3aeedc2b2b2fa221be8b075fa8e8357718d7b3fa447ac18f14ecc7065 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mahnud-mau-nanaayma (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67b04d32b02fde0c4293b500f7f54d3f19fec78aa5297b2b97165c135e48f522 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lintang-tea93 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b61ca3e1c59ce28728de34beb8dbac8972455d95780f068af223f5047e02d56 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in jeep-poke39 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0ddc983769eefb438f9559056140c73efd21a88525cf0cc4c201333e416cba7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teagood-lokika5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb2396dfe3ac8a8725be8a75de9cf22ea89b7113804c37f2960e60ea17d1ca40 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-153326 Malicious code in avminh-afai-faauofaog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9a20497e2f49a06e703b2180808504cc5df889af55c877f4e373016b29b0ec6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-158304 Malicious code in lookingan-konami43 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dabf714202b51b99aad16d2eb01f8b4d417ca92e07260729b35a1b734032c56a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-159764 Malicious code in mansila-iala-maonldauai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 368e5fc3daf142e244a356cf2b0818145e6c585647e682c70b26d4547feaa70e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149958 Malicious code in @mipta1/asia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6baafae6103b4d52636c20e9056676fa2b0051f41794b09ed1793be325776a73 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-9223

Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to the improper configuration in the execute program action feature...

EUVD-2025-124960

In the Linux kernel, the following vulnerability has been resolved: bpf: Enforce expectedattachtype for tailcall compatibility Yinhao et al. recently reported: Our fuzzer tool discovered an uninitialized pointer issue in the bpfprogtestrunxdp function within the Linux kernel's BPF subsystem. This...

CVE-2025-40123

In the Linux kernel, the following vulnerability has been resolved: bpf: Enforce expectedattachtype for tailcall compatibility Yinhao et al. recently reported: Our fuzzer tool discovered an uninitialized pointer issue in the bpfprogtestrunxdp function within the Linux kernel's BPF subsystem. This...

CVE-2025-40169 bpf: Reject negative offsets for ALU ops

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative offsets for ALU ops When verifying BPF programs, the checkaluop function validates instructions with ALU operations. The 'offset' field in these instructions is a signed 16-bit integer. The existing check...

CVE-2025-40123 bpf: Enforce expected_attach_type for tailcall compatibility

In the Linux kernel, the following vulnerability has been resolved: bpf: Enforce expectedattachtype for tailcall compatibility Yinhao et al. recently reported: Our fuzzer tool discovered an uninitialized pointer issue in the bpfprogtestrunxdp function within the Linux kernel's BPF subsystem. This...

CVE-2025-40123

CVE-2025-40123 is a Linux kernel vulnerability described in EulerOS advisory as a fix for the BPF tailcall compatibility check. The issue arises in the BPF subsystem where tailcalls could bypass constraints based on an program’s expected_attach_type, potentially enabling a NULL pointer dereferenc...

Malicious code in dagda-jabbah-xenos-dactyl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4678aea84d3e17daf26a71a1227863e69cfc430bb5d394a840da880b8ae787a6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in perseus-semantic-ui-publish-local (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b71fb1de6b922a4162887d97be7ff4e0e59a478a124163c67f61a729dd21dade This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prettier-plugin-markdown-mira-rollup-plugin-slides (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c59df9e16b1d88777561b0576f22280225530cc5984f4353928fdfe3d86100d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...