4574 matches found
Malicious code in umbra-iota-graphql-callback (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0216011a857c745443a164b8b961b2825a42498fd66c95b1ea56899885b894bd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-179633
Malicious code in commitlint-config-angular-graphql-ursa-yakutsk npm...
Malicious code in sqlite-oauth-quito-graphql (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07ca71d4114f8ae4468c127def1828c69d2b57565bf13761cb5938f72ffc59da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-178676
Malicious code in graphql-nightmare-css-loader-abiogenesis npm...
Malicious code in graphql-elektra-triton-transform (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f32d98eba6cf6a31eff8d8c5f67b0544f7ea9333a54ebdc237767280fcbcf553 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-179480
Malicious code in cryptography-biohacking-xml-graphql npm...
EUVD-2025-178126
Malicious code in less-loader-orbit-outercore-graphql npm...
EUVD-2025-175836
Malicious code in umbra-jekyll-foundation-graphql npm...
MAL-2025-187207 Malicious code in graphql-npm-soap-fermiparadox (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56716e434cd1c5a44faa2761e4607685f3dc1bfd3de906c84be90f3ba243a05b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in dysonswarm-apex-graphql-module (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00edc1420ef60c8781c29b4cfa9b3d8d0e4928fb48176c0fabe627e881d70830 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in miranda-markdown-pdf-rate-limiter-graphql (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e691ac26ae0b92394354fcda674316914c8f0464d09a7681898100fb4da7308 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-178678
Malicious code in graphql-elektra-triton-transform npm...
EUVD-2025-176240
Malicious code in sqlite-oauth-quito-graphql npm...
Cross-site Request Forgery (CSRF)
Apollo Studio Embeddable Explorer & Embeddable Sandbox are vulnerable to cross-site request forgery CSRF. The vulnerability is due to missing origin validation in the client-side handling of window.postMessage events, which allows an attacker to send forged messages that trigger arbitrary GraphQL...
EUVD-2025-121032
Malicious code in ultra-graphql-xo-deimos npm...
EUVD-2025-120694
Malicious code in vulcan-graphql-sadr-leda npm...
EUVD-2025-120615
Malicious code in webdriver-manager-dione-graphql-public npm...
EUVD-2025-120575
Malicious code in webdriver-mocha-lint-redis-graphql npm...