MAL-2025-181485 Malicious code in cewe30 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b369b4b9f7c7abc31be7f052c223858f2718a7f915f9cff526a96a0d5bb41451 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-181227 Malicious code in @akunsansan0/biru4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5a26f0b320fd3ed877e7d1fb7cded89b6249f8c634e942e361f92fcbd023b37 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-64429

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator pcg32 to generate cryptographic keys or...

EUVD-2025-150399

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator pcg32 to generate cryptographic keys or...

CVE-2025-64429

DuckDB 1.4.0–pre-1.4.2 encryption implementation is vulnerable due to multiple cryptographic weaknesses: insecure RNG (pcg32 fallback), possible memory wipe omission (memset) leaving secrets, and header manipulation could downgrade from GCM to CTR, bypassing integrity. There may also be unhandled...

CVE-2025-64429 DuckDB Encryption Crypto implementation is vulnerable

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator pcg32 to generate cryptographic keys or...

CVE-2025-64429 DuckDB Encryption Crypto implementation is vulnerable

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator pcg32 to generate cryptographic keys or...

Malicious code in teate-thy-sonic-odep (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c732a65558923b447b64e76e768d7a6ebd144705da94ee7dd778e357f71c7dd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-jimhab (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0547883a364d0554c4a4ccd7833d18cad8669f2d873ebf2b2ca870ec20971ac1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-zacam (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d791cfce26f0826292210a4f58c51526758b7d9760d1a133cc6de52766048acb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-hibuf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 624881d70ef5d7b76fc2985f1682189e036e0668863fa12f6facad957f6401ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-ifpoh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa6d7558a5a5e959cb72c519623ac5e7672499b2accebc7e7d594cf21e9b4125 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-cehoj (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5929ff129f94923443adfff08994c0ccbb2fb6ebb533e472d19464fa612be401 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-iwetob (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 212a48f0ba0d1f4699ebdb517f45ef598f35e9987232b890a702802c931873bb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-iralu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0165a3b5055f17ebfd3e9e05a0e761c6d85798f751477e87bd3ec31a64f8bde6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-jada (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cce993caeef57846e921d0499321d07fe93d1362dcc841ae5a6b442b5339a76c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-cetu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97416d4cf73cf949573a401d55834b6b7c48eb9cf5cd79c0be76bd551a93c4e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-jonmih (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 24469f5d705224c71d20d8f779e531515b8d727d31a9b77913c3e5565cb3d855 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lookingan-nanakila2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 894047360ac343660a163530f9c4ec4b7a6748c79e2d60c898ab23bccc4f2763 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-py-givner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d456d1a40062ac8418c0adae179a01ec289e167a6aa21e80a8ce0f13921ee215 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...