Malicious code in await-castor-middleware-chakra-ui (npm)

Source: amazon-inspector bce9d7732b56596adfb5fda97c2500f0a29f16cdba6713c3badf04c3d81f0b63 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in avior-leda-cordelia-middleware (npm)

Source: amazon-inspector d8ebc3dafe421376c8a68b4f99a070c82d6b07785161a4d708ff483c04935e82 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in auth-non-blocking-ini-middleware (npm)

Source: amazon-inspector 5c0b15945d56e729cf31bab7127c7e22fea1f173b7506f6861413ee2005b0fcf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in auth-middleware-phoebe-bootstrap (npm)

Source: amazon-inspector 5e3e51978571ca4dfff349d756ffbe01b1a5025c948ec27206dac4551be7b695 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in arthur-middleware (npm)

The package arthur-middleware was found to contain malicious code. --- Credit: OpenSSF source...

Incorrect Authorization

Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Incorrect Authorization in BaseApp.removeBase, FetchState pathname stripping, and matchRequest in the routing and app base-handling...

CVE-2026-84376

Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base "/app", a request to "/appX/admin" resolved internally to the protected...

CVE-2026-84376

Astro is a web framework for content-driven websites. Prior to 7.2.4 , it stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. For example, with base "/app", a request to "/appX/admin" resolved internally to the pro...

CVE-2026-84376 Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base

Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base "/app", a request to "/appX/admin" resolved internally to the protected...

CVE-2026-84376 Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base

Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base "/app", a request to "/appX/admin" resolved internally to the protected...

CVE-2026-84376 Astro: Authorization bypass from missing path-segment boundary check when stripping the configured base

Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base "/app", a request to "/appX/admin" resolved internally to the protected...

CVE-2026-84376

Astro is a web framework for content-driven websites. Prior to 7.2.4, Astro stripped a configured non-root base path from request pathnames using a string-prefix check without verifying a path-segment boundary. With base "/app", a request to "/appX/admin" resolved internally to the protected...

Malicious code in apex-resolvers-wolf-middleware (npm)

Source: amazon-inspector bead6dc416b174f4b3e1a8b7173da225f9499133ad4af86d6e834959ebd09d25 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in antares-mensa-husky-middleware (npm)

Source: amazon-inspector d3ab52c87195be1a836587e78a7a2e6c142f506ba8f5d53355404fb5772ed274 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in antares-less-loader-middleware-sequelize (npm)

Source: amazon-inspector ae569a3671d9274588de48ed5de8d667d2f2d636d898cc6832f261b42ef93686 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in antares-dagda-middleware-eclipse (npm)

Source: amazon-inspector b1ffcf858ce15c8cf2b6903a2a67f79e923a275ad287c517e0f23f1657995130 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in andromeda-middleware-lightyear-photon (npm)

The package andromeda-middleware-lightyear-photon was found to contain malicious code. --- Credit: OpenSSF source...

SUSE CVE-2026-82333

multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser synchronously iterate a maximum-length sparse array, blocking the event loop so the process cannot handle other requests. A larg...

Malicious Package

Overview bellatrix-middleware-yildun-eslint-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

SUSE CVE-2026-15603

morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remote clien...