Longitudinal Analyses of SAST Tools: A CodeQL Case Study

Open-source software OSS pipelines rely on automated static analysis tools to prevent the introduction of vulnerabilities in code. However, there is limited understanding of the efficacy of these tools across the OSS ecosystem over time. In this paper, we introduce a novel method to evaluate stat...

CVE-2025-64753

grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document could still access endpoints listing hashes for versions of that document and receive a full list of changes between versions, even if those changes contained cells, columns, or...

Malicious code in singularity-kuiperbelt-loopback-fermiparadox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f1afa76f7fe37851e702aa99f703e08b3365b03f94bca78843a30a75678da27 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in karma-remark-meissa-quasarjet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 24ba9b8f201e1838f0dfd5912cdccffa7d9283e7ef7d366a6fd932f1dc7a7ef6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lithosphere-pegasus-jest-paleoecology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fac9378ba65444786e230b66d8117785b3cbf66c7c6c667007647fd65d49e95 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in airbnb-australis-inflation-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08ecd16b89921defad1c9b79583eedf00225da0e26f2f98dc7a866f52c72ec13 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in node-config-hexo-version-indus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e9b65b9b8c11b124be12acd58301b389aedba3ac28ad6ab66fcf6f4ac2a0a2c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in development-kinetic-mocha-equinox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96160b948656b764d9430295e2b31751c70cbd633bb727db7d40e6ab62af00a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in puppeteer-tailwindcss-karma-postcss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d9679267623f6c6b49f81c8f19e9f271e992336207668f965e6348a4c9bbf98 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phi-private-async-earth-xi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b930c14e745c4ce4165a894796d9879c130ecb462db863194881e2488a88548 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prettier-meteor-mineralogy-vuepress (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7db2695a262bc6e69c6034c20bc2c7d9eff61f2b332c8b08bb2467def0f247e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in update-proxima-isostasy-archaeometry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ac93addf5705ec6be9762a965b872ca031400f21168925e440d5142383746b3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sagitta-whitedwarf-betelgeuse-plutology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2787349d2a0b1c5c6c6c213c0c755d72dd5c786eff681299c936ceca5da3a44 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in convict-writable-webpack-cosmogenic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d97564ab9fc4db43f4230b9d93ccc412d62ff1b73b25e6ee7eeca8c3f4298df7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in transhumanism-blueshift-thuban-geckodriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42d67c23d5b5afa24d365f038dfc900460ad6920968cb7725c1ff6a31a5a2172 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in adonis-cosmos-eslint-plugin-izar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f51440d13be3a94db6138efdff6d65f7d866cbf0118a7f11859f4508a808663 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in virtualreality-abiogenesis-passport-chalk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 216de1758c390287dbbb13dfbd2b313f02658117cb686365a5d236b6ffd10c7f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in perseus-astrobiology-xo-postgres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 209bc773fd8267be72905b2255aec7ca34c777cb43cffc9a378f21758053dd22 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in commitlint-config-angular-hercules-express-yonder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ddef34412e83c0fbe8a9644690f235972b287dd6c6f27c8589726648b3334e1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in run-script-juno-supernova-commitlint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28d5416570aa5bf98628db20b38d6aa688ee1a11743013f75bbbf34b033fb219 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...