Malicious code in scale-phi-deserialize-nu-sed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3da7cfb294f277c58d7e8fe6484b55c4210fc860ea9b97bd8165568c264fb168 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-179319

Malicious code in deserialize-double-simulate-interpret-tau npm...

EUVD-2025-179317

Malicious code in deserialize-rain-stub-alpha-socket npm...

EUVD-2025-176079

Malicious code in table-rho-deserialize-authorize-test npm...

EUVD-2025-179320

Malicious code in deserialize-book-cloud-awk-finally npm...

EUVD-2025-180456

Malicious code in alpha-deserialize-book-upsilon-pi npm...

EUVD-2025-179141

Malicious code in encode-route-deserialize-eta-export npm...

EUVD-2025-178443

Malicious code in import-scale-deserialize-sudo-visualize npm...

EUVD-2025-176175

Malicious code in string-route-theta-virtualize-deserialize npm...

EUVD-2025-176423

Malicious code in serialize-final-beta-deserialize-await npm...

EUVD-2025-176302

Malicious code in socket-table-grid-sigma-deserialize npm...

EUVD-2025-178905

Malicious code in final-bundle-zero-string-deserialize npm...

EUVD-2025-179378

Malicious code in decompress-deserialize-nu-new-emulate npm...

EUVD-2025-179211

Malicious code in easy-kernel-deserialize-public-await npm...

pkcs11-helper -- deserialize buffer overflow

Alon Bar-Lev reports: util: fix deserialize buffer overflow. thanks to Aarnav Bos...

EUVD-2022-0619

Malicious code in bioql PyPI...

EUVD-2025-31172

Malicious code in bioql PyPI...

Incorrect Authorization

Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Incorrect Authorization via the deserializecompact function. An attacker can bypass intended authorization policies by crafting a signed token with unknown critical head...

PT-2025-38752

Name of the Vulnerable Software and Affected Versions Authlib versions prior to 1.6.4 Description Authlib’s JWS verification improperly handles tokens declaring unknown critical header parameters crit, violating RFC 7515 specifications. An attacker can create a signed token with a critical header...

EUVD-2025-30225

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command injection...