CVE-2025-64525 Astro: URL manipulation via unsanitized headers leads to path-based middleware protections bypass, potential SSRF/cache-poisoning, CVE-2025-61925 bypass

Astro is a web framework. In Astro versions 2.16.0 up to but excluding 5.15.5 which utilizeon-demand rendering, request headers x-forwarded-proto and x-forwarded-port are insecurely used, without sanitization, to build the URL. This has several consequences, the most important of which are:...

EUVD-2025-178056

Malicious code in lithosphere-quark-mesosphere-cache npm...

EUVD-2025-179912

Malicious code in cache-umbra-geoarchaeology-server npm...

EUVD-2025-179917

Malicious code in cache-meta-root-try-key npm...

EUVD-2025-177290

Malicious code in pegasus-cache-passport-vortex npm...

EUVD-2025-179921

Malicious code in cache-cat-index-async-small npm...

EUVD-2025-179531

Malicious code in cosmogenic-genomics-scripts-cache npm...

EUVD-2025-179271

Malicious code in dorado-spectron-webdriver-spectron-cache npm...

EUVD-2025-179516

Malicious code in cressida-cache-iota-antares npm...

Malicious code in cressida-cache-iota-antares (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector efdc68100f25ab316f603e943cc9672495c31169a3534af578cd94b80cb0b020 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-179919

Malicious code in cache-less-venus-supercluster npm...

EUVD-2025-177884

Malicious code in meta-fire-validate-refactor-cache npm...

EUVD-2025-179848

Malicious code in cat-void-bash-cache-bundle npm...

EUVD-2025-179910

Malicious code in cache-xml-stub-fire-nu npm...

EUVD-2025-175607

Malicious code in webdriver-mocha-browserify-polaris-cache npm...

EUVD-2025-178022

Malicious code in long-nu-new-nu-cache npm...

EUVD-2025-179251

Malicious code in double-decode-encrypt-cache-bundle npm...

MAL-2025-187741 Malicious code in lepton-cache-soap-hexo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 540a8b1aab1653ea9186f5db7ed0ff5ad6f8e7fb307f940830c94da18ed1a149 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-178141

Malicious code in lepton-cache-soap-hexo npm...

Malicious code in phoenix-cache-dione-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c61ea44437b917008ecbd1d94b0404d4d54de209060e2a6548bfe2374ef498e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...