MAL-2025-166825 Malicious code in teagood-cuekin58 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6be57b1fe9eff229d23f0716fd00dca397bca4d38e39b4911663eca0b7ee810 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-158346 Malicious code in lookingan-konami81 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36129a4362f716737e5fbe02c3673096289c257168fd4aa24c05bd8baf743d09 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-150464 Malicious code in @mipta19/wdub1r (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ac396b9f0cf18ee4d560cc78dc7803e0119ca179a3286b99b1e18fd04a25111 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in docusaurus-sync-aurora-aquarius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de322dc14cbf09d6210fe4f1063f229a8881ac8ba3a9ed3a70a31dd85cc166d4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in yakutsk-dactyl-ini-astro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf395e7b3693a939d7ad32c6e4cc5ae06e04fa347b15775871942a5e6c28d16d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in exec-markdown-pdf-lyra-postgres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ba57287ed1f74c1a4a3b805756b3c4022fb5695ff5ffedbc4695321e339df30 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144621 Malicious code in magellan-alphard-cygnus-sirius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fb03d334d5fb3fded9247c374d838c01faefeb9b836133ef2f495a0c002fda2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141758 Malicious code in dotenv-safe-lint-standard-stream (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f96ce93bc5896847055a774b8ee4747daf6ed0538e96b9ffb3a4bcc8c1f03366 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in javascript-dotenv-quasar-spica (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 996a3dae89f9b7e3bb0b73ff7640c83fb95b29c9f700d3dfa3ecbecaa30be33a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phoebe-rimraf-transport-gravity (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d320839b4d250dc51a6c8d4afcf02325f2d067157ca501e732ebea5362aa8ce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149463 Malicious code in wezen-mira-pm2-fusion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48dfb675efc87f46b8c1732d0a186062453d40de5752664af00e8082b7ca5d40 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146780 Malicious code in publish-concurrently-gacrux-sirius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2cfe0c3e58ae6358bb280c4b65e3b0a5ad1a578037814733f4f7581aa92c89c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-43205

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to bypass ASLR...

CVE-2025-43205

An out-of-bounds access issue in Apple's Audio component (specifically affecting watchOS ) was addressed with improved bounds checking. This vulnerability could allow an application to bypass ASLR . The issue is fixed in watchOS 11.4 , iOS 18.4 , iPadOS 18.4 , iPadOS 17.7.6 , macOS Sequoia 15.4 ,...

Malicious code in nurul-nasicampur96-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13e77e1d3e9fb2e1a3d99ded628afd515a126697010dbd93e3ae5c2913c48a3b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gita-klipo34-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b399b44754745859b1bee70f5adb821aa2fe46a7872638813e4411b4303a3fc1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-132622 Malicious code in continuous_fly_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9def6fceb456b061c00e498a11707262f85486cef1aff1695db10f81d7d4f341 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-133641 Malicious code in galih-lodeh63-sumpek (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d674665f8394621734f9d8e3f4188925bd144f9c8463def7dc4aeadd6e642f3e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zaki-nasipecel90-sumpek (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9252da46485dcda4ae44a8cb2d979f822e5be798ccdf571518721c96b7ea655 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-133670 Malicious code in galih-tempe23-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a15d029c4047909db626462bb701d329e2130b6805d1d9a66cc96459d697ac8b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...