Malicious code in continued-chocolate-rook (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 123f2fde06d448f82543d4935ac3574bc93a68f4aed75d4b4545c06cdcfed666 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-51830

Malicious code in stale-moccasin-rook npm...

EUVD-2025-52919

Malicious code in opposite-tomato-rook npm...

Malicious code in opposite-tomato-rook (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27d8e3b86d9f72edab82c0e3082b44d471dc00893e74adc3b51ebc064442f512 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sunny-brown-rook (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 606fecd2863215c3fbe106de1459eb6af860ef37dd533756ea4c1a6bc3d68637 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-65283 Malicious code in shrill_rook_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74fbe8fe2f4ac19527052c30c5f30b27be8f5a2fab0dd5453652558f63247acf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-44283

Malicious code in yummyrookz3n npm...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: seaweedfs, k8ssandra-client, secrets-store-csi-driver-provider-azure-fips, grafana-agent-operator, postgres-operator, cortex-fips, influx, restic, rqlite-fips, thanos, flux-helm-controller, prometheus-operator, kubecolor, witness, metallb-fips, apko-fips, cerbos,...

CVE-2024-51744 affecting package rook for versions less than 1.6.2-26

CVE-2024-51744 affecting package rook for versions less than 1.6.2-26. A patched version of the package is available...

CVE-2025-27144 affecting package rook for versions less than 1.6.2-25

CVE-2025-27144 affecting package rook for versions less than 1.6.2-25. A patched version of the package is available...

CVE-2025-30204 vulnerabilities

Vulnerabilities for packages: eksctl, sftpgo-plugin-pubsub, zarf, flux-image-reflector-controller, scorecard, terraform-provider-azurerm, crossplane, policy-controller, crossplane-provider-azure-storage, thanos, pulumi, kubernetes-dashboard-auth, azcopy, kyverno-policy-reporter-ui, weaviate,...

AZL-77535 CVE-2025-30204 affecting package rook 1.6.2-27

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...

CVE-2022-3162 affecting package rook for versions less than 1.6.2-24

CVE-2022-3162 affecting package rook for versions less than 1.6.2-24. A patched version of the package is available...

CVE-2024-28180 affecting package rook for versions less than 1.6.2-23

CVE-2024-28180 affecting package rook for versions less than 1.6.2-23. A patched version of the package is available...

CVE-2024-6104 affecting package rook for versions less than 1.6.2-21

CVE-2024-6104 affecting package rook for versions less than 1.6.2-21. A patched version of the package is available...

AZL-42922 CVE-2024-6104 affecting package rook for versions less than 1.6.2-21

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7...

CVE-2024-35255 vulnerabilities

Vulnerabilities for packages: cosign, argo-workflows, prometheus-operator, fluent-bit-plugin-loki, falcoctl, fulcio, wal-g, zarf, harbor-registry, flux-image-reflector-controller, spire-server, guac, rclone, policy-controller, step-ca, buildkitd, flyte, pulumi, thanos, sigstore-scaffolding, trino...

CVE-2024-28180 vulnerabilities

Vulnerabilities for packages: cosign, gitsign, argo-workflows, fulcio, falcoctl, grpc-health-probe, kubernetes-dashboard, apko, spire-server, temporal, guac, zarf, policy-controller, step-ca, rabbitmq-messaging-topology-operator, wolfictl, sigstore-scaffolding, zot, aactl, falco, kube-rbac-proxy,...

AZL-35859 CVE-2024-28180 affecting package rook for versions less than 1.6.2-23

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if t...

CVE-2021-44716 affecting package rook for versions less than 1.6.2-19

CVE-2021-44716 affecting package rook for versions less than 1.6.2-19. A patched version of the package is available...