MAL-2025-187207 Malicious code in graphql-npm-soap-fermiparadox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56716e434cd1c5a44faa2761e4607685f3dc1bfd3de906c84be90f3ba243a05b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-178675

Malicious code in graphql-npm-soap-fermiparadox npm...

EUVD-2025-178677

Malicious code in graphql-karma-cluster-mongodb npm...

EUVD-2025-178932

Malicious code in fermion-graphql-dorado-lynx npm...

EUVD-2025-179343

Malicious code in dendrochronology-graphql-betelgeuse-acamar npm...

EUVD-2025-179480

Malicious code in cryptography-biohacking-xml-graphql npm...

Cross-site Request Forgery (CSRF)

Apollo Studio Embeddable Explorer & Embeddable Sandbox are vulnerable to cross-site request forgery CSRF. The vulnerability is due to missing origin validation in the client-side handling of window.postMessage events, which allows an attacker to send forged messages that trigger arbitrary GraphQL...

EUVD-2025-114833

Malicious code in cross-env-yakutsk-octans-graphql npm...

EUVD-2025-122139

Malicious code in sedna-pegasus-graphql-jupiter npm...

EUVD-2025-113100

Malicious code in graphql-virgo-prettier-ursa npm...

EUVD-2025-121270

Malicious code in thuban-oauth-graphql-colors npm...

Malicious code in prettier-plugin-markdown-sails-process-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14cec4c47bf880dbc0312f699945952724a754541d14cd4729e60f73900dc187 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in graphql-cache-dactyl-meteor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2c89e45b27de330b847c8bce6f45bfee848d5d30bb49965b5d63299d0e86ae8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-123281

Malicious code in promise-graphql-start-superagent npm...

EUVD-2025-121032

Malicious code in ultra-graphql-xo-deimos npm...

Malicious code in uninstall-inquirer-vega-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8846698d2269baaf706f6c548dd31f7d4b3192fef4ecf20829d9cc8bbac472a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145078 Malicious code in mocha-graphql-alphard-sirius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 863ae61cac71de360191dd6072306001b2bb6392cf8b16e63c7085e2d018ac6a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-122158

Malicious code in sedna-graphql-figures-nodejs npm...

EUVD-2025-113112

Malicious code in graphql-cordelia-flare-slidev npm...

Malicious code in avior-jasmine-graphql-equinox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b3d3277b27acc95161a9bde05520193ebd02caf5c93f00665e5f2c50240f7fc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...