5323 matches found
EUVD-2025-179103
Malicious code in epigenetics-graphql-tailwindcss-abiogenesis npm...
Malicious code in miranda-markdown-pdf-rate-limiter-graphql (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e691ac26ae0b92394354fcda674316914c8f0464d09a7681898100fb4da7308 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-179480
Malicious code in cryptography-biohacking-xml-graphql npm...
MAL-2025-187207 Malicious code in graphql-npm-soap-fermiparadox (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56716e434cd1c5a44faa2761e4607685f3dc1bfd3de906c84be90f3ba243a05b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Cross-site Request Forgery (CSRF)
Apollo Studio Embeddable Explorer & Embeddable Sandbox are vulnerable to cross-site request forgery CSRF. The vulnerability is due to missing origin validation in the client-side handling of window.postMessage events, which allows an attacker to send forged messages that trigger arbitrary GraphQL...
EUVD-2025-114833
Malicious code in cross-env-yakutsk-octans-graphql npm...
EUVD-2025-113103
Malicious code in graphql-selenium-antares-luna npm...
EUVD-2025-124840
Malicious code in mocha-graphql-alphard-sirius npm...
EUVD-2025-112969
Malicious code in halley-graphql-miranda-changelog npm...
Malicious code in vulcan-graphql-sadr-leda (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b28fd7869c1e84447ed5bb31e1a38bd35e970545d9af54c68a3ce47e58301765 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in configstore-graphql-pm2-virgo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0df4450f2fb42c74059bdf2515b13d9ec227be42735da764c21f0c090c58f9c0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-122120
Malicious code in selenium-hapi-graphql-convict npm...
EUVD-2025-121939
Malicious code in slides-graphql-markdown-pdf-dynamo npm...
EUVD-2025-121607
Malicious code in stream-graphql-levels-sedna npm...
EUVD-2025-123542
Malicious code in postcss-atlas-graphql-spectron-webdriver npm...
EUVD-2025-123428
Malicious code in prettier-plugin-markdown-sails-process-graphql npm...
Malicious code in stop-flare-graphql-webdriverio (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39fd5efa47d0de28572480beb46c4b09366251f5981c1cbd75c0877711c8b1dd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-116783
Malicious code in alphard-cassini-graphql-warp npm...