MAL-2025-181239 Malicious code in @akunsansan0/biru50 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a26e3275292e15a314ce58373d38e5ce5d0e5e4db69c9a9d6d82c0a1d2797014 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-64429

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator pcg32 to generate cryptographic keys or...

CVE-2025-64429

DuckDB 1.4.0–pre-1.4.2 encryption implementation is vulnerable due to multiple cryptographic weaknesses: insecure RNG (pcg32 fallback), possible memory wipe omission (memset) leaving secrets, and header manipulation could downgrade from GCM to CTR, bypassing integrity. There may also be unhandled...

EUVD-2025-150399

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator pcg32 to generate cryptographic keys or...

CVE-2025-64429 DuckDB Encryption Crypto implementation is vulnerable

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator pcg32 to generate cryptographic keys or...

CVE-2025-64429 DuckDB Encryption Crypto implementation is vulnerable

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator pcg32 to generate cryptographic keys or...

Malicious code in teate-thy-py-tunne (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6755bbc4dcf177e923dbff66477a1b10d9b4a57ceb78a7f7ef9aba39765d6466 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-burem (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c6fa7f6f65f9c7b7bb92ce56cce51817aa35030369306adccdecafa982bf5db This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-saded (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a81735df5599d5d6a5570774d79e19b0d6354ef802655efae0ca35baf918886 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-morum (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e8c076708ba7ced4794c9d59266face8f977c1a4a77503d0a1519b2f4744dd1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lookingan-jaja90 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1873348f80006bc58769ecd7e0b5358d5a2006b759987e9e144fd9774abd3346 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-jeclij (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62cce1f6b89f4932910c26e72a5de895153940f5245a945edb2ae6a854b230b0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-afiv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebb57b8ca848196f05334cef0dce42703428af5ac3bb21e360eaf6c966619ad9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kiut-acg-avefivubuug (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54b842cb4f5ce8eccf3617c90c574da332300709409e5344037db49d81d86027 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-zeoh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 972cad35d6eb5f56e7c4652f5421a6973920622bc16d82306cf4d90672fd6618 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in anais-papmoa-yamaing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc4fba198d62127f71356bbddb3306a11b6dd6860c517c11f08e9589f0977e2b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lookingan-nanakila35 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca8ea2756ec9529f2a327c8c221ebac761512f4d2dfcb93e4a12f34541b1d7aa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kiut-acog-avefivubufuaadvig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fad3190478e2da8af4ab6081f76660abca98b22b1df5cdeae86ad286700f923c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-ahva (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4e19e3bcaa839bf6f9dcb5963d3efded76130a5e01dd54f864b2c513bf469ba This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-olsac (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9cea493349603a29e0069bc8f5fe592eda3a2eb40cb624043cab230ec5dee949 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...