MAL-2025-142140 Malicious code in eridanus-apollo-webpack-ursa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05b6d3fa2f2b87fcc3aa5e1370bba47b406350a2e793c8bc6d599b8bbd58135d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-116602

Malicious code in apollo-command-prompts-electron npm...

Malicious code in taurus-apollo-postgres-colors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0c504442fde8f0ce95ca21f1150316e44ec42643db293dbf940a6307e028fde This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-114823

Malicious code in csrf-init-apollo-hyperion npm...

EUVD-2025-121068

Malicious code in typeorm-typeorm-development-apollo npm...

MAL-2025-142606 Malicious code in fornax-apollo-dependencies-sirius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19d63b4026e2998bfa09edf925373b6179b99d47e1d6cbe6439ca7a0b37dad39 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-122185

Malicious code in scripts-miranda-nconf-apollo npm...

EUVD-2025-124789

Malicious code in mongodb-grus-despina-apollo npm...

EUVD-2025-120101

Malicious code in yonder-apollo-ophiuchus-titan npm...

MAL-2025-144770 Malicious code in mdx-miranda-apollo-nightwatch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45e7684b2c1caccbc41129dd131debd88ef627e42a25ac781346f8d69986211f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142720 Malicious code in fusion-apollo-style-loader-envconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81e697bff033a44314f01620f35bf49c622e6ce1d0f971103c8b1871fda65d10 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142225 Malicious code in eslint-plugin-apollo-supervisor-aquarius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c97c4417371354dc864ac05316ad3f9ffd6bf4a85eeec03dd87dd816e428dc88 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in vortex-apollo-luna-eris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c40a7b13b8ae9ef5abf8a3a983d8979e4b96529ff8dfde107ef9f83fa76537b2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in farout-changelog-apollo-kaus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c724dbf3bc227757e4c0bf560f5f7313bab426730af0b9d0c024502630d4c8c9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-123308

Malicious code in procyon-rehype-promise-apollo npm...

MAL-2025-139530 Malicious code in apollo-server-terser-webpack-plugin-quantum (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 242351a23e7cfbb27df8dcfbf0a3ce9e20b76ec9c4b6267b770b2fa7c8a05448 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141788 Malicious code in draco-apollo-arcturus-luna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 334f290cf81f2e9cde3da527c346dd097f89ac61d370ee906265eab329ee5e26 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142032 Malicious code in enceladus-pm2-metalsmith-apollo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dd6535d0df808138b8c1274dc7cc91e10777d5e12474f13dd805e3e6828a0e1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-64347

Apollo Router Core is a configurable Rust graph router written to run a federated supergraph using Apollo Federation 2. Versions 1.61.12-rc.0 and below and 2.8.1-rc.0 allow unauthorized access to protected data through schema elements with access control directives @authenticated, @requiresScopes...

CVE-2025-64173

Apollo Router Core is a configurable graph router written in Rust to run a federated supergraph using Apollo Federation 2. In versions 1.61.11 below, as well as 2.0.0-alpha.0 through 2.8.1-rc.0, a vulnerability allowed for unauthenticated queries to access data that required additional access...