MAL-2025-186265 Malicious code in concurrently-configstore-lyra-perseus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbdd3e3fbd31161db4d4c071bc50e19eb1af1064e748a5e2f0131d7ff033d0b1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kapvino-socni-fuvavha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6afc5605dc505d4a316e13558daaf96540b5b02f2dbca8a4b187b5133993baee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nabuf-oguuof-dufio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f15387e77383a31e02059913883a99e6074ec47f3f68475e21f12cdd3b727da2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teagood-nakama20 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4336633a9609eccaff4299ffeb1f5d4b03f96a5971a297c9701984f86d065a4e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aril-49 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42277d7c7e46f9b5bc7a56f62c0378c88b2237b988ae45185f7f676f1b31bce1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sunderan-udilasuinsak-vakaali (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8af5c06fe50d4e1c709a0e80719eef5f6e61840559d8f11d99c25df57e2eab3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fadhil-jengkol66-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 270591510e12ef8056d9c14bfb93cf840613bf75c0ca3d5798a6bf33b158392b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tuti-telurtahu49-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2659a313c7a9b24bd070a76cf17cdfa945c374663ae8daee234c2a84b404c01 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wasteful_dove_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a587243031c63af392e1c9ad4660575e5fd3161eeb99d83beaec1765007ddcb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in territorial_halibut_indigo-40 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dc9bfc29a15860088bf626f96fa582e435b7736aed757bebdf23e4bb4eafefd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-105398 Malicious code in lutfi-gembus91-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f2628cf97bc8db1b0014edbab8aa6e726d946a9fc05e9fa9fb2b459c9ba23ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-106014 Malicious code in mulyono-lapis1-remi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc2b8c0464c1b12459f5c33ec3b4ea0b3abb23f126279947a4c70213d04a71f8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ida-dodol92-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2709d3919650cf16c8e70128941f50ce67b2e3d12b5a7932b960d07c58f70a8a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-78614 Malicious code in hadi-sasag42-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f04abcc9554daae9508793a9c31c796c7bcc46784ec3b9397b7ac154d3cf188e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-68573 Malicious code in grand-violet-eagle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce2acb8108780ad6fcb19d3dc4ed8fb862b7f4a5e9d3943b0fb5de2cea99748b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-54319 Malicious code in putri-kentang100-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d2ea649ee3acfde6751ffbaf8592210321ae1c1ffd0f0ac6cf3d92598804ac5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Friday Squid Blogging: Squid Mating Strategies

Some squids are "consorts," others are "sneakers." The species is healthiest when individuals have different strategies randomly. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...

Libdwarf: crashes randomly on fuzzed object

...

CVE-2022-47037

Siklu TG Terragraph devices before 2.1.1 allow attackers to discover valid, randomly generated credentials via GetCredentials...

Information disclosure

A randomly generated Initialization Vector IV may lead to a collision of IVs with the same key potentially resulting in information disclosure...