EUVD-2025-121210

Malicious code in toml-nestjs-achernar-spectron npm...

Malicious code in atlas-uglify-js-dependencies-playwright (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7c01fe1d39d88bf4cd5a8c1ea901406f329f7b4aba7ecd8aabf15ba9c3ada4a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in perseus-ora-spawn-uglify-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69f9b2d497f009b9eed372879b921b29be260e3950fa8d2f8639d0075b3e34e7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in uglify-js-upgrade-scorpius-cors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5a619ce4025267f0cd25ec403515e25fd7c994673f76fb3a0cbac6469abc6d4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-115909

Malicious code in build-unuk-uglify-js-configstore npm...

EUVD-2025-121051

Malicious code in uglify-js-pegasus-proxima-superagent npm...

Malicious code in scorpius-uglify-js-grunt-mdx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa7bf0478efc3b2a9cce6d79cf93e4ccee6ad6fb3c74baa90e251c8477bf18ce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-121975

Malicious code in sirius-fork-nodejs-bellatrix npm...

EUVD-2025-116673

Malicious code in antares-pegasus-request-uglify-js npm...

EUVD-2025-121050

Malicious code in uglify-js-quantum-vuepress-publish npm...

EUVD-2025-124766

Malicious code in mongoose-firebase-local-uglify-js npm...

PT-2025-46851

Name of the Vulnerable Software and Affected Versions js-yaml versions prior to 4.1.1 Description js-yaml is a JavaScript YAML parser and dumper. A flaw exists where an attacker can alter the prototype of a parsed YAML document, leading to prototype pollution. This impacts users parsing untrusted...

EUVD-2025-75204

Malicious code in worriedcod-gooddev npm...

EUVD-2025-62316

Malicious code in regionalfireflyz3n npm...

CVE-2025-13018

Mitigation bypass in the DOM: Security component. This vulnerability affects Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5...

EUVD-2025-44032

Malicious code in reactjs-fabric npm...

CVE-2025-64167: Improper Neutralization of Input During Web Page Generation

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to a cross-site scripting attack leading to JS execution when editing the URL parameter. Versions 2.7.13 and 3.2.2 don't use export.php, which was deprecated. They use export-v2.php instead...

PT-2025-47235

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=458199402 Crash type: Heap-use-after-free READ 8 Crash state: JS DefineProperty build backtrace JS CallInternal...

PT-2025-47066

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=457858149 Crash type: Use-of-uninitialized-value Crash state: JS DefineProperty build backtrace JS CallInternal...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the jsarraybufferslice function. An attacker can access sensitive information or cause application instability by triggering a buffer over-read through crafted input. Remediation A fix was pushed into the...