1897 matches found
@akunsansan0/tea_guntry99 (1.1.5), tea_guntry99 (>=1.1.2, <=1.1.6) potentially affected by unknown CVE via tea_guntry99 (1.1.7)
teaguntry99 NPM version 1.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on teaguntry99 and may be impacted: - @akunsansan0/teaguntry99 1.1.5 - teaguntry99 =1.1.2, =1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-181570...
@jazuli/terakhir558 (1.1.4), abufda-muyu-bgagfaug (1.1.0) +4949 more potentially affected by unknown CVE via terakhir558 (1.1.5)
terakhir558 NPM version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on terakhir558 and may be impacted: - @jazuli/terakhir558 1.1.4 - abufda-muyu-bgagfaug 1.1.0 - bufa-muyu-bgagfaug 1.1.0 - bufai-muyu-bgagfaug 1.1.0 - bufani-muiyau-fafu 1.1.0 -...
siddheshtea (1.1.6) potentially affected by unknown CVE via nudela-rahfeg-nahahgsa (1.0.0)
nudela-rahfeg-nahahgsa NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on nudela-rahfeg-nahahgsa and may be impacted: - siddheshtea 1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-163841...
siddheshtea (1.1.6) potentially affected by unknown CVE via nokire-nakala38 (1.0.0)
nokire-nakala38 NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on nokire-nakala38 and may be impacted: - siddheshtea 1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-162991...
Malicious code in lookingan-nalako87 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34301443f937e5258814341a066b41cff635ac64defbf622aa253d0acd51a649 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
absolute_woodpecker_dumbs (1.2.1), academic_eel_dumbs (3.3.1) +2428 more potentially affected by unknown CVE via arts-dao (1.1.5)
arts-dao NPM version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on arts-dao and may be impacted: - absolutewoodpeckerdumbs 1.2.1 - academiceeldumbs 3.3.1 - academicmolluskdumbs 1.4.1 - acceptablefishdumbs 2.4.4 - acceptablemoledumbs 1.3.3 -...
Malicious code in candra-tongseng89-ruro (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49b839915eddb3990d12210a729bd9589048ab104c266b5687908cf0907fbd4d The package candra-tongseng89-ruro was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...
Nation-State Hackers Deploy New Airstalk Malware in Suspected Supply Chain Attack
A suspected nation-state threat actor has been linked to the distribution of a new malware called Airstalk as part of a likely supply chain attack. Palo Alto Networks Unit 42 said it's tracking the cluster under the moniker CL-STA-1009 , where "CL" stands for cluster and "STA" refers to...
PhantomRaven Malware Found in 126 npm Packages Stealing GitHub Tokens From Devs
Cybersecurity researchers have uncovered yet another active software supply chain attack campaign targeting the npm registry with over 100 malicious packages that can steal authentication tokens, CI/CD secrets, and GitHub credentials from developers' machines. The campaign has been codenamed...
Supply Chain Attack
@metamask/sdk, @metamask/sdk-communication-layer, and @metamask/sdk-react are vulnerable to Supply Chain Attack. The vulnerability is due to a compromised debug package that injected malicious code, allowing attackers to intercept or tamper with dApp-to-wallet communications...
Self-Spreading 'GlassWorm' Infects VS Code Extensions in Widespread Supply Chain Attack
Cybersecurity researchers have discovered a self-propagating worm that spreads via Visual Studio Code VS Code extensions on the Open VSX Registry and the Microsoft Extension Marketplace, underscoring how developers have become a prime target for attacks. The sophisticated threat, codenamed...
Serious F5 Breach
This is bad: F5, a Seattle-based maker of networking software, disclosed the breach on Wednesday. F5 said a "sophisticated" threat group working for an undisclosed nation-state government had surreptitiously and persistently dwelled in its network over a "long-term." Security researchers who have...
Vesta Control Panel 安全漏洞
Vesta Control Panel VestaCP is an open source web hosting control panel. A security vulnerability exists in Vesta Control Panel version ee03eff and prior versions, which stems from embedded malicious code that could lead to a supply chain attack and administrator credential disclosure...
(0Day) Wondershare Repairit SAS Token Incorrect Permission Assignment Authentication Bypass Vulnerability
This vulnerability allows remote attackers to bypass authentication on Wondershare Repairit. Authentication is not required to exploit this vulnerability. The specific flaw exists within the permissions granted to an SAS token. An attacker can leverage this vulnerability to launch a supply-chain...
EUVD-2021-19498
Malware in sbrugna...
CVE-2025-61774
PyVista provides 3D plotting and mesh analysis through an interface for the Visualization Toolkit VTK. Version 0.46.3 of the PyVista Project is vulnerable to remote code execution via dependency confusion. Two pieces of code use--extra-index-url. But when --extra-index-url is used, pip always...
EUVD-2024-26935
Malicious code in bioql PyPI...
EUVD-2025-31073
Malicious code in bioql PyPI...