EUVD-2025-116494

Malicious code in astro-izar-enceladus-grunt npm...

EUVD-2025-121420

Malicious code in terser-achernar-cassini-astro npm...

EUVD-2025-114203

Malicious code in electron-builder-leda-astro-restart npm...

EUVD-2025-116483

Malicious code in astro-vortex-commitlint-prompts npm...

EUVD-2025-112403

Malicious code in iota-astro-ophiuchus-ini npm...

EUVD-2025-111976

Malicious code in kaus-bellatrix-async-astro npm...

EUVD-2025-112172

Malicious code in jovian-astro-aldebaran-ignite npm...

EUVD-2025-122454

Malicious code in rocket-hermes-tailwindcss-astro npm...

EUVD-2025-115402

Malicious code in chariklo-mongoose-dependencies-astro npm...

EUVD-2025-123343

Malicious code in procyon-capella-astro-request npm...

EUVD-2025-120233

Malicious code in xerxes-astro-axios-rocket npm...

MAL-2025-147890 Malicious code in server-astro-publish-capella (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e83cd2758dd0aac6c01e758c20525f18a2e37ad3a0c7a149db689bdb07e720e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145695 Malicious code in nuxtjs-astro-dotenv-toml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 361f069c8f34b46d870c8a13f9857e804499b8f943a16c7ba015da58b6adddfe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139610 Malicious code in astro-lynx-spectron-webdriver-cluster (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9049322941e5324e2a72b89dd2bec6a6c4657ed11046ca9603fb10c28fe22098 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147462 Malicious code in rocket-astro-cli-zenith (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c472ed77c736a9963eff49b3598afb091fc41500d7bc9f3cbff19ef5c0966701 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-59837

Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery SSRF and...

CVE-2025-59837

Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery SSRF and...

CVE-2025-59837 astro allows bypass of image proxy domain validation leading to SSRF and potential XSS

Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery SSRF and...

CVE-2025-59837

Astro (web framework) versions 5.13.4–5.13.9 vulnerable to image proxy domain validation bypass via backslashes in the href, enabling server-side requests to arbitrary URLs and potentially SSRF and XSS. Root cause: incomplete fix for CVE-2025-58179; fix implemented in 5.13.10. Affected component:...

CVE-2025-59837 astro allows bypass of image proxy domain validation leading to SSRF and potential XSS

Astro is a web framework that includes an image proxy. In versions 5.13.4 and later before 5.13.10, the image proxy domain validation can be bypassed by using backslashes in the href parameter, allowing server-side requests to arbitrary URLs. This can lead to server-side request forgery SSRF and...