CVE-2025-7062: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability has been identified in the H5P module h5p-nodejs-library by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of...

PT-2026-88878

A stored cross-site scripting XSS vulnerability has been identified in the H5P module h5p-nodejs-library by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of...

Malicious code in duplex-parcel-nodejs-membrane (npm)

Source: amazon-inspector fa06346c89852e6b9c279cbd0b49045bb71d5ff9157585fa04bc9c20fbbf44d1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in dotenv-nodejs (npm)

Source: amazon-inspector 14a15bdceba2f650e2c3d04e2be33994e406c2548812e89a520fc511c2529266 The package dotenv-nodejs was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in despina-photon-nodejs-on (npm)

Source: amazon-inspector 3152b5d159e60035f53ed829f5362c99844bd6585f8e614ae1b496a79ee78f46 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

CVE-2026-45820 vulnerabilities

Vulnerabilities for packages: tileserver-gl-fips, commercial-gitlab-rails-ee, lambda-nodejs, langfuse, langfuse-fips, commercial-gitlab-rails-ee-fips, librechat, tileserver-gl...

GHSA-PX8P-9VWX-VF98 vulnerabilities

Vulnerabilities for packages: tileserver-gl-fips, commercial-gitlab-rails-ee, lambda-nodejs, langfuse, langfuse-fips, commercial-gitlab-rails-ee-fips, librechat, tileserver-gl...

CVE-2026-15157 affecting package nodejs for versions less than 24.20.0-1

CVE-2026-15157 affecting package nodejs for versions less than 24.20.0-1. An upgraded version of the package is available that resolves this issue...

CLSA-2026-1788538849 nodejs: Fix of 2 CVEs

CVE-2026-56846: retain HTTP/2 header-block memory in session accounting for the stream's lifetime instead of releasing it once headers reach JS, preventing a maxSessionMemory accounting bypass via stalled headers - CVE-2026-56848: defer RSTSTREAM submission while nghttp2 is still dispatching...

Malicious code in dagda-nodejs-magellan-mysql (npm)

Source: amazon-inspector 792a64ac652bb6ab18229a861d7f5b30e92db6d2015ab8974b4e844b2e63c799 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in convict-query-nodejs-prettier (npm)

Source: amazon-inspector 947879ab9208e82054fd505807da031763a35a0ff420bdf7e46e98c33eec225d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in constructor-blocks-landings (npm)

Source: amazon-inspector 28cdac4c3410baaaa9054b53e7d5ed9260e8322d3164fc5e1670c2ac15efa98b On require of the package's main entrypoint, index.js loads setup.js which selects an OS/architecture-specific asset and downloads a binary from a rotating list of hostnames assembled at runtime via...

Malicious code in console-color-nodejs (npm)

The package communicates with a domain associated with malicious activity. --- Credit: OpenSSF source...

Malicious code in confluent-examples-nodejs (npm)

The package confluent-examples-nodejs was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in commitlint-config-angular-nodejs-carpo-vortex (npm)

Source: amazon-inspector aff6171864c8dd888f734cabf61ae22f26f3868044dd59eb396032310cdbcf72 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in commitlint-config-angular-ganymede-nodejs-mysql (npm)

Source: amazon-inspector abfd879ab632f0dd68339b7adf07134b5953b4df890f07de2df9bb6408002bdd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in commitlint-config-angular-cressida-nodejs-winston (npm)

Source: amazon-inspector 51233a99373fbba970ffb051b6d35dfb5c790bf689ce0c29ae1c2bb9f36c160c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in celeste-baryon-stop-nodejs (npm)

Source: amazon-inspector 846401c80326a995821fe08966683abd9e419a6930435b3f12e358b285781155 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in carpo-nodejs-react-bootstrap-hyperion (npm)

The package carpo-nodejs-react-bootstrap-hyperion was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in carina-transport-nodejs-sirius (npm)

Source: amazon-inspector 9674ba3bb4b51d8d50b8bcffcf19428bbdce221fc44e026cbf3f7e6947c75775 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...