MAL-2025-55434 Malicious code in budi-gulai53-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18aeaa38f2197f6a207ac9b422edc64555095bee57dc657b6df9ec4d2e27546f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-57999 Malicious code in ogi-serimuka76-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f19e40c79df5cef4d3036dc9ff5ac0e2a3667c60f6344c74eec15fbc36394374 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-54839 Malicious code in sinta-brengkes12-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a449b07297e2746393564069c95bea85e42f316aabbd070c3f1f020b733c7b22 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in okta-mangut80-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b482657438e4f5ef07e4d07cb52516ecb25494da2d45603b2ecbba8b15e4512 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-53809 Malicious code in lina-kue68-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1a118c2185d6d5a4360a78cb1ea6be560509282d39066ddaa5866ad12f2d307 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-54953 Malicious code in surya-asinan68-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a13912e2ac5d402cdd44926c9a1b55564b9cce300cf9952bbc29edc2f890f45 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in maman-ruwet47-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e493adc577402181413a0ddd564e5c073bf52706e45c84225c1524638b303eac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in maman-ongol-ongol19-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0bcf86a212d086df859c6a2871433322bcefcd17547bf27409c127fdf8631c9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-53586 Malicious code in ocha-esdoger69-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8e6d242e40d12f8905e0b9dd1849ccd1caa9cb4388b615d384e041e1c323d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-53548 Malicious code in nurul-lontong95-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b39984e65f3d257ba34cc81f79a07b7c54de3d730c31e6ed51ea19986fbf7f1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in andi-telur75-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d408bbda31e701242e81908eff0db91759ce5a4d1ccd185344d6e762c399994 The package andi-telur75-ruro was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

MAL-2025-52378 Malicious code in tania-kue42-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 887b1d469f90ed779f56e9911db5752904a07e644da7bdf05946d01836f30a3a The package tania-kue42-breki was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

Malicious code in udin-lontong47-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ce0856581fc21c748ac7d25d0a6f25cf8f469f3e2fbda9a5e73460492436ce0 The package udin-lontong47-breki was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flood...

MAL-2025-52689 Malicious code in wati-teh84-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9cf67d7fe693dae9df6160fe5e6170d90995c6e5991d82190db81ea6dfd123d The package wati-teh84-breki was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded n...

CVE-2025-64177

ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. In versions 0.6.7 and below, there is a stored Cross-Site Scripting XSS vulnerability in the dashboard, which can exploited when a user clicks on a malicious bookmark, made vulnerable by the lack of scheme...

PT-2025-45385

Name of the Vulnerable Software and Affected Versions ThinkDashboard versions prior to 0.6.8 Description ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript. A stored Cross-Site Scripting XSS issue exists in the dashboard for versions 0.6.7 and below due to a...

Path Traversal

esm.sh is vulnerable to Path Traversal. The vulnerability is due to improper sanitization of user-supplied URL components allowing path-traversal and file-scheme requests by which an attacker can craft specially-formed requests that cause the server to read and return arbitrary local files or oth...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: A memory leak occurs when free is called on olddamonsysfsschemefilter-memcgpath during writing. The memcgpathstore function assigns a newly allocated memory buffer to filter-memcgpath, without deallocating...

OESA-2025-2545 qt5-qtbase security update

Qt is a software toolkit for developing applications. Security Fixes: An issue was found in the private API function qDecodeDataUrl in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. If the function was called with malformed data, for example, an URL that...

Security Bulletin: IBM QRadar Hub for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM QRadar Hub for IBM QRadar SIEM has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2025-58754 DESCRIPTION: Axios is a promise based HTTP clien...