MAL-2025-139499 Malicious code in apollo-colors-hapi-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30be78f711f92871cf9ef17406d921ae42feb235c2054887bde10f6c7e489426 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140023 Malicious code in blaze-hapi-cordelia-start (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f2782e9e52c196340de0e31caff03aa3bee08b7d416ac2a4d310277517eed08 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-121742

Malicious code in spica-yakutsk-hapi-gatsby npm...

MAL-2025-139333 Malicious code in alphard-odin-radiant-hapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 061b018c3c576a12e91b1414b540a920cf4d9a62aa4d6901c07ab7ef1b75bd98 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-143194 Malicious code in hapi-phenomic-cors-nebula (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6f2c548eec7b1c2d839951c25a7b0a8543b92f3c4bcf2e77b2171ec7401b245 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chalk-sirius-commitlint-hapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5bba1e8688eb4ecf682073f2e20d6832d25b7acebe1f8a59e848fc460540dd7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-112929

Malicious code in hapi-hyperion-corvus-upgrade npm...

EUVD-2025-112934

Malicious code in hapi-cluster-firebase-elektra npm...

EUVD-2025-112333

Malicious code in jabbah-hapi-eslint-config-centauri npm...

EUVD-2025-112933

Malicious code in hapi-commitizen-update-semantic-release npm...

EUVD-2025-112921

Malicious code in hapi-miranda-changelog-ini npm...

Malicious code in betelgeuse-hapi-dynamo-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41a35da202899a19f4d2770c7c1cd9956c0a0b82316c6be52a6712a1fbfb1568 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-116034

Malicious code in blitz-zenith-flare-hapi npm...

EUVD-2025-115343

Malicious code in chromedriver-csrf-ariel-hapi npm...

EUVD-2025-115127

Malicious code in commitlint-event-hapi-duplex npm...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.4), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.4) +13 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.2.4.release)

org.springframework:spring-websocket MAVEN version 4.2.4.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.4 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.6), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.6) +6 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.3.0.release)

org.springframework:spring-websocket MAVEN version 4.3.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.6 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (1.5), ca.uhn.hapi.fhir:hapi-fhir-testpage-overlay (1.5) +10 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.2.5.release)

org.springframework:spring-websocket MAVEN version 4.2.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base 1.5 -...

ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base (>=2.0, <=2.2), com.ahome-it:ahome-tooling-server-core (>=1.1.4-release, <=1.1.9-release) +12 more potentially affected by CVE-2025-41254 via org.springframework:spring-websocket (4.3.1.release)

org.springframework:spring-websocket MAVEN version 4.3.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-websocket and may be impacted: - ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base =2.0, =1.1.4-release, =1.1.4-release,...

ca.uhn.hapi.fhir:hapi-fhir-cli-api (>=7.0.0, <=8.4.3), ca.uhn.hapi.fhir:hapi-fhir-cli-app (>=7.0.0, <=7.4.5) +130 more potentially affected by CVE-2025-59250 via com.microsoft.sqlserver:mssql-jdbc (>=12.3.1.jre8-preview, <=12.4.2.jre11)

com.microsoft.sqlserver:mssql-jdbc MAVEN version =12.3.1.jre8-preview, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =1.0.0-beta1, =1.0.0-beta1, =1.0.0-beta1, =1.6.10, =2.3.1, =2.3.1, =2.3.1, =2.3.1, =2.3.2 and more Source cves: CVE-2025-59250 Source advisory: SNYK:JAVA-COMMICROSOFTSQLSERVER-13821835...