MAL-2025-141984 Malicious code in element-ui-spinner-bootstrap-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 955b49c0bd95c502fd03223c8164d7331c570f17e89327a7346c250f55ee2f63 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141932 Malicious code in electron-semantic-ui-local-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f8ae4d278c10bbf43bd015302566ba9e83c2ad8462dec439b9985e4afdb95ef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140631 Malicious code in chakra-ui-vega-express-soap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20c0df3b2ac23be1e355e72eb882ad33832dee620205b49d584c3786346b4f50 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147842 Malicious code in semantic-ui-concurrently-enceladus-toml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e9348abe7dceafcbea1bb3601475a31350792e0fcf6ac6edef9d9fbc27f3268 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147854 Malicious code in semantic-ui-perseus-firebase-cypress (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 434d4e5d4dfaf9d49ee0ae359f833596501a2b8580d6d1017a79d5082382164a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146647 Malicious code in promise-registry-bellatrix-element-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab1a5c501ec3299dcc8dfa9935e0f26ed824255bb5062b9cb5ddfe62fbd4f34c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140611 Malicious code in chakra-ui-cypress-juno-pm2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32cdf185ec38aecbc412f7e0635a106bdbaf491f09b8eb1449089a252ce03054 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140618 Malicious code in chakra-ui-jekyll-algol-prompts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5237ebfd128d365a85baec16de6eb6ccaef065fb763230f647aa7d58e3f3ad1f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140623 Malicious code in chakra-ui-nodemon-metalsmith-loop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d3fd1864b9a5129d2c4228d9955e4d3dc9c799a3aa1f4b18ba2932dd5c4fcdb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-12729

Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-12435

Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-12447

Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

CVE-2025-11212

Inappropriate implementation in Media in Google Chrome on Windows prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-11210

Side-channel information leakage in Tab in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

KLA90003 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions, execute arbitrary code, spoof user interface. Below is a complete list of vulnerabilities: 1. Race condition vulnerability in the...

MAL-2025-66543 Malicious code in @walletwave/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15e6b9673bf6056f0f870d3aa6ad6c4e83ef1a3bf3b58a601dc9cae80d673390 The package @walletwave/ui was found to contain malicious code. Source: ghsa-malware 42ec23f1a72e982a80ced819057ca03a0d26999dc6b7417343456de67a35ec46...

EUVD-2025-50790

Incorrect security UI in SplitView in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted domain name. Chromium security severity: Low...

EUVD-2025-50789

Incorrect security UI in Omnibox in Google Chrome on Android prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

EUVD-2025-50784

Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

EUVD-2025-50795

Inappropriate implementation in Autofill in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Low...