MAL-2025-187386 Malicious code in hugo-nashira-boson-passport (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 728679d568943b8e701a38466dcaf011a95064ea258b5e16ed806bdee8ef90f4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zeta-lambda-abstract-eta-secure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b820d228c75228585ef00e24bee4183f5a0dff3ec86ddc4b9cc4727395b97ed5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sahu-sat-faguao (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f4a84882abdddf9fcdc30ed3a16b45eae18397664dd5a4eae53b3a68e703bbc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ahmarnaeem (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c54fa352e0e2feaa230d697ef4661bf59997e93204fcee133c8e44a161c94abf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in diago-kulipo-lukafahkai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 701d3b8859efc71850bed601a0861495a7c3cc6d89fdc22a923aaad821dff6de This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in auth0-bellatrix-flare-webdriver-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5e8fb78cbfe2b9703119843bcf9dc9fed3a416b3af62cc1f848ee7ed6c007a6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mdx-loglevel-meissa-meissa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 909e4c33893b2a01e7ce57de10e579ce8302c27633a661dfbed926ef6435f9d3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in quarrelsome_gorilla_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12078ba8dc186595574f7a82c307313dc1c23a229eda548bd4a1b9b1b297e29a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-120572 Malicious code in hendra-getuk3-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1679d2bb602abbf3785e9e1b55b29fc5e244447bd2d20667b5ed9da33cd01c07 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-94068 Malicious code in distinguished_ape_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fae8563afd9027c37850ec7ae07e5d7019a58dedb3fd306e60f62dfbe360557a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in judicial_bison_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bd68366f839c738509b9b95d8d8a30ffcba95f1c5cd888c9f1409fbf3590a1f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tasty_mammal_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c484f97f47ddbc86cc8224e1b21ead87e08c9ccf5a7851dc16c62e982b68c5b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in eko-martabak68-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98e45547788d43540cbdc59654f2bd9e40051ad7acbbcab5b1ff6f5e5e7a073a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-80867 Malicious code in qori-lengko28-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c2a2f66e9b3140d21fca17d1a6042c170c8758b93343a68c532b36a243ca0fe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Alt Redirect: Potential Authentication Bypass by Spoofing through query-string stripping logic flaw

The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Strip" feature is enabled. Case variations, encoded keys, and duplicates are not removed, allowing attackers to bypass sanitization. This may lead to cache poisoning, parameter...

CVE-2025-60868

The Alt Redirect 1.6.3 addon for Statamic fails to consistently strip query string parameters when the "Query String Strip" feature is enabled. Case variations, encoded keys, and duplicates are not removed, allowing attackers to bypass sanitization. This may lead to cache poisoning, parameter...

JLSEC-2025-14 cairo 1.16.0, in cairo_ft_apply_variations() in cairo-ft-font.c, would free memory using a free func...

cairo 1.16.0, in cairoftapplyvariations in cairo-ft-font.c, would free memory using a free function incompatible with WebKit's fastMalloc, leading to an application crash with a "free: invalid pointer" error...

PT-2025-41562

Name of the Vulnerable Software and Affected Versions Statamic Alt Redirect version 1.6.3 Description The Alt Redirect 1.6.3 addon for Statamic does not consistently remove query string parameters when the "Query String Strip" feature is enabled. Variations in case, encoded keys, and duplicate...

CVE-2025-62185

In Ankitects Anki before 25.02.5, a crafted shared deck can place a YouTube downloader executable in the media folder, and this is executed for a YouTube link in the deck. The executable name could be youtube-dl.exe or yt-dlp.exe or yt-dlpx86.exe...

EUVD-2025-5675

Malicious code in bioql PyPI...