Malicious code in tool-tailwindcss-cosmology-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 024cbd055f4aa386cbd24118ce725f651db3fc425f37acf6453c7e535d8d1d1a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-177538

Malicious code in norma-tool-stratigraphy-stop npm...

EUVD-2025-179176

Malicious code in electron-tool-nashira-gemini npm...

EUVD-2025-179352

Malicious code in delphinus-tool-sync-geckodriver npm...

EUVD-2025-175571

Malicious code in weywot-tool-eslint-config-dotenv npm...

Malicious code in pipe-auth0-barnard-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93b3b68d9a0c694ca31182e0583f4bf4ee987574a2c4a765974633b4f89dc72c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tool-wavefunction-ultra-gridsome (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6440db217bbb9f167b1f6b7b229fe260c8138b56561aaeb8a50a4cfe2d6b38b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-190305 Malicious code in weywot-tool-eslint-config-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de32a7540b8c3b3d21739c05102b00d5a46e140039e3c22f2265e6addf4f43d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186530 Malicious code in delphinus-tool-sync-geckodriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 309471f78b1f61e3fba41e092a36d4ae761dc2439a6686d82cea711c93a982ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189959 Malicious code in tool-wavefunction-ultra-gridsome (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6440db217bbb9f167b1f6b7b229fe260c8138b56561aaeb8a50a4cfe2d6b38b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-177161

Malicious code in pipe-auth0-barnard-tool npm...

EUVD-2025-180393

Malicious code in apex-tool-colors-cz-conventional-changelog npm...

Malicious code in tool-nightmare-cryovolcano-cryptography (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a76c88215df8fdb3d155deb47358326c302d81107bace56723235b1944267551 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-177067

Malicious code in prettier-plugin-markdown-tool-sociobiology-css-minimizer-webpack-plugin npm...

EUVD-2025-179170

Malicious code in element-ui-commitlint-convict-chai npm...

EUVD-2025-177163

Malicious code in pino-virtualreality-cluster-tool npm...

EUVD-2025-179694

Malicious code in cluster-tool-quasarjet-meteor npm...

EUVD-2025-175922

Malicious code in tool-callisto-betelgeuse-axios npm...

PT-2025-46861

MaxKB is an open-source AI assistant for enterprise. In versions prior to 2.3.1, a user can get sensitive informations by Python code in tool module, although the process run in sandbox. Version 2.3.1 fixes the issue...

MaxKB 代码问题漏洞

MaxKB is a 1Panel-dev open source open source knowledge base question and answer system based on a large language model and RAG. A code issue vulnerability exists in MaxKB versions prior to 2.3.1, which stems from a user being able to access internal web services via Python code in a tool module,...