4930 matches found
EUVD-2025-178676
Malicious code in graphql-nightmare-css-loader-abiogenesis npm...
Malicious code in sqlite-oauth-quito-graphql (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07ca71d4114f8ae4468c127def1828c69d2b57565bf13761cb5938f72ffc59da This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-179103
Malicious code in epigenetics-graphql-tailwindcss-abiogenesis npm...
MAL-2025-187207 Malicious code in graphql-npm-soap-fermiparadox (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56716e434cd1c5a44faa2761e4607685f3dc1bfd3de906c84be90f3ba243a05b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in miranda-markdown-pdf-rate-limiter-graphql (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e691ac26ae0b92394354fcda674316914c8f0464d09a7681898100fb4da7308 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-179480
Malicious code in cryptography-biohacking-xml-graphql npm...
Cross-site Request Forgery (CSRF)
Apollo Studio Embeddable Explorer & Embeddable Sandbox are vulnerable to cross-site request forgery CSRF. The vulnerability is due to missing origin validation in the client-side handling of window.postMessage events, which allows an attacker to send forged messages that trigger arbitrary GraphQL...
EUVD-2025-114833
Malicious code in cross-env-yakutsk-octans-graphql npm...
EUVD-2025-113105
Malicious code in graphql-pegasus-yildun-reveal-md npm...
EUVD-2025-113103
Malicious code in graphql-selenium-antares-luna npm...
EUVD-2025-124840
Malicious code in mocha-graphql-alphard-sirius npm...
EUVD-2025-112969
Malicious code in halley-graphql-miranda-changelog npm...
Malicious code in vulcan-graphql-sadr-leda (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b28fd7869c1e84447ed5bb31e1a38bd35e970545d9af54c68a3ce47e58301765 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in configstore-graphql-pm2-virgo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0df4450f2fb42c74059bdf2515b13d9ec227be42735da764c21f0c090c58f9c0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-122120
Malicious code in selenium-hapi-graphql-convict npm...
EUVD-2025-121939
Malicious code in slides-graphql-markdown-pdf-dynamo npm...
EUVD-2025-121607
Malicious code in stream-graphql-levels-sedna npm...
EUVD-2025-121275
Malicious code in thuban-graphql-backend-jupiter npm...