MAL-2025-181308 Malicious code in @akunsansan0/karedok37 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec41ca60a53945b53d95e51ea049918914f0071f4575b4a8a9c890ff6bd819df This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-181511 Malicious code in kopi1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 075bc07912c66f901e5bb925929fab970bcd021edb8a7922894da2fad8587ef7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-181400 Malicious code in baso42 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcab899be034032f904d16ba7959e075f6c8239a39ce1ea85004fbe63d94877a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-181429 Malicious code in baso7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bda593797387a43621cb93594afbed039c8642a6c2a7fb84dcf960a9b99f7eee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-181545 Malicious code in roti37 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2019bbf1e7b6c2b854fd035e196ee689e6ec7c36178b2bf8e0774563fe1c807d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in roti20 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9dab0e4c176ce580b76fb0d45d46fb2799e45fcdf0c2b5d0374c9ced5793eac0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in baso31 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be2649424bfb044d8386f79e587c5bd59388abe908e4aaff01044bfba9efbf12 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-181397 Malicious code in baso4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4048fea7dd6062fa84d984ef6ffda110213e690d0537c3034047be3ab61dde42 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-181259 Malicious code in @akunsansan0/jorelat11 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d45438deaf189f973e8f7c291ef5d3c87b8d22537bdad1658159ea1a914f24a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-181444 Malicious code in baso84 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ef5eafece7b262363112e158ba153779abe5d85d7cdd99a93b168b6dd978e58 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-181295 Malicious code in @akunsansan0/karedok25 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 157f29442f148d3b344103b45865c1b2ddbe2fc0b35ef36d667f85ecd3f3619b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in @akunsansan0/biru3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e6ac633cff1fd7296646ca5c16332fc4a578d5ebfd532d358cb23b2e7fe558e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-64429

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator pcg32 to generate cryptographic keys or...

EUVD-2025-150399

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator pcg32 to generate cryptographic keys or...

CVE-2025-64429 DuckDB Encryption Crypto implementation is vulnerable

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator pcg32 to generate cryptographic keys or...

CVE-2025-64429

DuckDB 1.4.0–pre-1.4.2 encryption implementation is vulnerable due to multiple cryptographic weaknesses: insecure RNG (pcg32 fallback), possible memory wipe omission (memset) leaving secrets, and header manipulation could downgrade from GCM to CTR, bypassing integrity. There may also be unhandled...

CVE-2025-64429 DuckDB Encryption Crypto implementation is vulnerable

DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The DuckDB can fall back to an insecure random number generator pcg32 to generate cryptographic keys or...

Malicious code in teate-thy-sonic-jolul (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51f9ec8daf59d613123ccf4375a32cfc98118b29bcb2f5507137790055a41aeb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-pija (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3bbbd86192fa3030a4480885d30aa03f872bc32a24f6e48d74ef8b90b696fff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-retan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbcc871178f1663bdc2b054cfb795afe7a855d1c75edced312a7d81c25907f6f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...