CGA-644H-55G8-MMPX

Bulletin has no description...

EUVD-2025-200987

A local privilege escalation vulnerability exists in the InstallationHelper service included with Plugin Alliance Installation Manager v1.4.0 for macOS. The service accepts unauthenticated XPC connections and executes input via system, which may allow a local user to execute arbitrary commands wi...

Malicious code in tailwind-scrollbar-variant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c7a64f578e119daa50df50bd0cd9178bd4035b7ca595a72dc2b10da57b658d9 The package tailwind-scrollbar-variant was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-200199

Malicious code in tailwind-scrollbar-variant npm...

MAL-2025-191553 Malicious code in tailwind-scrollbar-variant (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c7a64f578e119daa50df50bd0cd9178bd4035b7ca595a72dc2b10da57b658d9 The package tailwind-scrollbar-variant was found to contain malicious code. Source: ghsa-malware...

North Korean Hackers Deploy 197 npm Packages to Spread Updated OtterCookie Malware

The North Korean threat actors behind the Contagious Interview campaign have continued to flood the npm registry with 197 more malicious packages since last month. According to Socket, these packages have been downloaded over 31,000 times, and are designed to deliver a variant of OtterCookie that...

Validator.js 安全漏洞

Validator.js is a string validator open source by validatorjs A security vulnerability exists in Validator.js versions prior to 13.15.22, which stems from the isLength function not taking into account the Unicode variant selector, which could lead to improper string length calculation...

MINI-88P4-V8V8-VV3X

Bulletin has no description...

ToddyCat: your hidden email assistant. Part 1

Introduction Email remains the main means of business correspondence at organizations. It can be set up either using on-premises infrastructure for example, by deploying Microsoft Exchange Server or through cloud mail services such as Microsoft 365 or Gmail. However, some organizations do not...

Siemens RUGGEDCOM ROS Devices Improperly Implemented Security Check for Standard (CVE-2021-42017)

A new variant of the POODLE attack has left a third-party component vulnerable due to the implementation flaws of the CBC encryption mode in TLS 1.0 to 1.2. If an attacker were to exploit this, they could act as a man-in-the-middle and eavesdrop on encrypted communications. This plugin only works...

Malicious code in apollo-ceres-package-cors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 361a97cac0a8ce666550c7ace3fa953bb91e64481b6e65e216965363c50c3fb4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in aquarius-relay-pulsar-eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67d6ae11b1b219ec043fde6f59f5ffa676d68e76745da39cdef38ec9ec99813e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in astro-photon-publish-blazar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfb6468812cdca3cbb6f3ebfbf8ac1b3a003fa7818d9ca76518f64c943efdf09 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in async-psi-alpha-query-theta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7530cf46aad481c6839f10e0bee406d9caae82ffc06acdedcc54ce75442b73cb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in authorize-code-bash-encrypt-abstract (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd5863c4c6b7c7c4948eaf1cdb4d635734791e194435e929c9dc3d24a822889e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bunyan-radioastronomy-interstellarmedium-outercore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83cc54e68d097377490b89849ea3a8203a0b8b2af36ff8e9b2ab0361325f59df This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in colors-request-xo-xerxes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1498b0185b55cab24bef95e606502bbbd2afbfe23c40d14a9b5f91cec7b05faf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in commitizen-antares-magellan-saturnology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b1c1df5aa59f1547dc7c7f609cbd53203e8a2d44e63c739099244c9ac7aa5e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in commitlint-config-angular-forever-dotenv-parse-variables-google (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e8eabd8ef0a60fb9207674e7219976cda9db0950935484582aa5086ac905614 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cordelia-indus-cors-dotenv-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b161dd83470ad8e5d5e7fae8eb08ea363c660e9e4d923d81d7c6716a5955553a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...