MAL-2025-140205 Malicious code in bulma-blaze-europa-spawn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2187e3df5f25fa89e7d582ad2b49cb8dd54a88d1dc8b42e7694934d80e7d5b99 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-115218

Malicious code in comet-spawn-oberon-xerxes npm...

MAL-2025-148240 Malicious code in sqlite-spawn-ultra-eclipse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3be06e9b3e8c2658261f00ccc757cc103e2be3f4c5ae7c655f5dd153755439ee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-123819

Malicious code in perseus-ora-spawn-uglify-js npm...

MAL-2025-147814 Malicious code in selenium-spawn-graphql-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15bb56bc9a2d81ce14a1bcff9a5dbebd2ee2ca22986cf4b6b12e88a5f9903b15 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-124122

Malicious code in odin-mira-spawn-protractor npm...

MAL-2025-131184 Malicious code in wati-nasi31-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22b62bdd8bb3ef3715ffb99157ce4556fff230a13a94a9e9386c3fbdf826b89f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-76173 Malicious code in wawan-kacang97-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c3481849aeccab32d0e4fc8feb25e14eaaf16132ea6d85fa2eb9251ae40c667 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tiara-miemee99-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37002bc3d9b417de9102e657e18767c1a66286588e129bc5609c25d689f932f1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in iwan-telur91-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0948d6b17113169f89a36c7f264cb43c47f816c5d57f124e302327a478c053b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Security Bulletin: IBM Maximo Application Suite uses multiple third party dependencies which are vulnerable to CVEs.

Summary IBM Maximo Application Suite uses "form-data 4.0.0, org.apache.cxfcxf-core 3.6.7 , net/http/internal v1.24.1, braces 3.0.2 , cross-spawn 7.0.3 , crypto/x509 1.24.1 1.24.3 , github.com/golang-jwt/jwt/v4 github.com/golang-jwt/jwt/v5 v4.5.0 v5.2.1 , httpd 2.4.37 , setuptools 78.0.2 75.8.0 ,...

Security Bulletin: IBM Maximo Application Suite - Manage Component uses cross-spawn-6.0.5.tgz which is vulnerable to CVE-2024-21538

Summary Security Bulletin: IBM Maximo Application Suite - Manage Component uses cross-spawn-6.0.5.tgz which is vulnerable to CVE-2024-21538. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2024-21538 DESCRIPTION: Versions of the...

NewStart CGSL MAIN 7.02 : nodejs Vulnerability (NS-SA-2025-0245)

The remote NewStart CGSL host, running version MAIN 7.02, has nodejs packages installed that are affected by a vulnerability: - Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service ReDoS due to improper input...

GHSA-QPM2-6CQ5-7PQ5 happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript

Summary The mitigation proposed in GHSA-37j7-fg3j-429f for disabling eval/Function when executing untrusted code in happy-dom does not suffice, since it still allows prototype pollution payloads. Details The untrusted script and the rest of the application still run in the same Isolate/process, s...

happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript

Summary The mitigation proposed in GHSA-37j7-fg3j-429f for disabling eval/Function when executing untrusted code in happy-dom does not suffice, since it still allows prototype pollution payloads. Details The untrusted script and the rest of the application still run in the same Isolate/process, s...

EUVD-2016-7715

Malware in sbrugna...

EUVD-2019-3855

Malware in sbrugna...

EUVD-2016-7716

Malware in sbrugna...

EUVD-2021-0530

Malware in sbrugna...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-986306)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-986306 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix bad pointer dereference when ehandler kthread is invalid Commit 66a834d09293 scsi...