Open Redirect

Koa is vulnerable to Open Redirect. The vulnerability is due to improper validation of the Referer header in the back redirect functionality, which allows an attacker to craft specially formed URLs treated as safe relative paths and force a user’s browser to redirect to an external, potentially...

EUVD-2025-178179

Malicious code in koa-version-scorpius-ceres npm...

EUVD-2025-176584

Malicious code in run-script-koa-json-cli npm...

EUVD-2025-178411

Malicious code in ini-koa-adonis-astrometry npm...

EUVD-2025-179365

Malicious code in deimos-koa-build-figures npm...

EUVD-2025-175491

Malicious code in xerxes-koa-promise-meteor npm...

Malicious code in miranda-koa-fetch-duplex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0542faa9fd01fa72c958cf46a1d5a08f0ba4db727709a088052187230321c063 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-179301

Malicious code in development-rollup-pipe-koa npm...

EUVD-2025-178181

Malicious code in koa-prettier-stylelint-link-google npm...

EUVD-2025-177902

Malicious code in mensa-koa-castor-typeorm npm...

Malicious code in koa-higgs-jasmine-wezen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a94744e4363382314160fd2c7e5b498755be2a10ae9e8fa7b684813a28d90a46 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-179597

Malicious code in configstore-jabbah-koa-public npm...

EUVD-2025-176760

Malicious code in redshift-run-script-chai-koa npm...

EUVD-2025-177629

Malicious code in neutronstar-quark-dotenv-safe-koa npm...

EUVD-2025-179770

Malicious code in changelog-middleware-koa-betelgeuse npm...

Malicious code in xerxes-koa-promise-meteor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f7f2f61998e11d01a86b314c656f657f5b480c9796ae6910da2c471584dfafc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-178184

Malicious code in koa-callback-postcss-loader-webdriver-manager npm...

EUVD-2025-178185

Malicious code in koa-betelgeuse-luna-cassini npm...

EUVD-2025-175469

Malicious code in xo-koa-metalsmith-perseus npm...

EUVD-2025-177807

Malicious code in miranda-koa-fetch-duplex npm...