CVE-2026-2258

Affected software: aardappel lobster up to 2025.4. Vulnerable component: WaveFunctionCollapse function in library dev/src/lobster/wfc.h. Issue causes memory corruption via local manipulation. Exploit has been published and may be used. A patch is available (commit c2047a33e1ac2c42ab7e8704b33f7ea5...

EUVD-2025-177794

Malicious code in mocha-eventhoriz-wavefunction-redshift npm...

EUVD-2025-177592

Malicious code in nightwatch-nashira-wavefunction-perturbation npm...

EUVD-2025-177484

Malicious code in odin-holography-wavefunction-webpack npm...

EUVD-2025-179638

Malicious code in commitizen-singularitarianism-framework-wavefunction npm...

EUVD-2025-175586

Malicious code in webpack-less-heliophysics-wavefunction npm...

EUVD-2025-176608

Malicious code in rollup-nova-wavefunction-rimraf npm...

EUVD-2025-176862

Malicious code in quantumfoam-wavefunction-lacerta-singularity npm...

EUVD-2025-178502

Malicious code in html-webpack-plugin-wavefunction-local-ora npm...

EUVD-2025-175630

Malicious code in wavefunction-ariel-pavo-equinox npm...

EUVD-2025-176939

Malicious code in public-eclipse-wavefunction-entanglement npm...

MAL-2025-188290 Malicious code in nightwatch-nashira-wavefunction-perturbation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6c4b64c33f7412381a1d500dcafadddadb2f2c59a0d9bf14721c9e7e3ff107f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-190249 Malicious code in wavefunction-parallax-jovian-jasmine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 938e05e40ad6861d8df01b57009bd79edb9c666be6fa41d3d26d00852d06cb71 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-175916

Malicious code in tool-wavefunction-ultra-gridsome npm...

EUVD-2025-175626

Malicious code in wavefunction-perturbation-stratosphere-supercluster npm...

EUVD-2025-175627

Malicious code in wavefunction-parallax-jovian-jasmine npm...

EUVD-2025-178478

Malicious code in hydra-regulus-wavefunction-spectron npm...

EUVD-2025-180241

Malicious code in augmentedreality-version-wavefunction-spawn npm...

EUVD-2025-175625

Malicious code in wavefunction-procyon-archaeoastronomy-uranology npm...

Malicious code in wavefunction-prompts-webdriver-mocha-vuetify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9133d1deb74b2792ed8706555c49fa13ce1ca719f838438eaefd5622916c5386 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...