EUVD-2025-135398

Malicious code in thumbi-vs-trsud npm...

Malicious code in thambi-rasdfa-vs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fa43b4c6a2653ab2af27d8ea855c30e2f06f41277f915ecfa5538da507e5136 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-135558

Malicious code in thambi-terd-vs npm...

EUVD-2025-135513

Malicious code in thambi-vs-budi npm...

EUVD-2025-135396

Malicious code in thumbi-vs-trsyud npm...

EUVD-2025-135397

Malicious code in thumbi-vs-trsyud npm...

Malicious code in thambi-vs-budi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 011978d111934865e8564f2d7fdb33ad91d6c1e36fb5f6ee9c1f768da23218fc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-179165 Malicious code in thumba-vs-budi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b2054eaa613a1e74d99b93749e1c6db189e02b2e715cf702e34afac0d3ff46c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-135514

Malicious code in thambi-vs-budi npm...

MAL-2025-179173 Malicious code in thumbi-vs-trud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ab027cf060ac98adddd8456064cd11199dd4fa65b1792a1c6df1af0d553a96d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-135403

Malicious code in thumbi-vs-budehi npm...

MAL-2025-179103 Malicious code in thambi-vers-vs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 927ee9a00201c5a6763c0ba818a743bca38d4d7a529c141e0fc19190913274d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-179088 Malicious code in thambi-terd-vs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bb642e3de0c4ffeac07d047b341b46933e801716caff6076729938a00184b17 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-179175 Malicious code in thumbi-vs-yunit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 932bc33c6478912fbedd1e7db522bcd4d2fee122a9ba408d810194baa4563094 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in made-vs-munchen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f725f4df60377cab8edb4d7a7ee8225fc9e4f54de6ae4854a425b1e80160c41 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-158996 Malicious code in made-vs-munchen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f725f4df60377cab8edb4d7a7ee8225fc9e4f54de6ae4854a425b1e80160c41 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-40150

The CVE-2025-40150 entries describe a Linux kernel F2FS issue where a race between fallocate on a pinning file and block allocation can migrate a just-allocated segment, causing mismatch between in-memory SIT and on-disk SSA (example segno 173822). The root cause is a race in garbage collection t...

CVE-2025-62794: Insufficiently Protected Credentials

GitHub Workflow Updater is a VS Code extension that automatically pins GitHub Actions to specific commits for enhanced security. Before 0.0.7, any provided Github token would be stored in plaintext in the editor configuration as json on disk, rather than through the more secure "securestorage" ap...

Self-Spreading 'GlassWorm' Infects VS Code Extensions in Widespread Supply Chain Attack

Cybersecurity researchers have discovered a self-propagating worm that spreads via Visual Studio Code VS Code extensions on the Open VSX Registry and the Microsoft Extension Marketplace, underscoring how developers have become a prime target for attacks. The sophisticated threat, codenamed...

Self-Spreading 'GlassWorm' Infects VS Code Extensions in Widespread Supply Chain Attack

Cybersecurity researchers have discovered a self-propagating worm that spreads via Visual Studio Code VS Code extensions on the Open VSX Registry and the Microsoft Extension Marketplace, underscoring how developers have become a prime target for attacks. The sophisticated threat, codenamed...