Arbitrary Code Injection

Overview react-server-dom-parcel is a React Server Components bindings for DOM using Parcel. This is intended to be integrated into meta-frameworks. It is not intended to be imported directly. Affected versions of this package are vulnerable to Arbitrary Code Injection via unsafe deserialization ...

CVE-2025-55182

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes...

CVE-2025-55182

A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes...

Node.js React Server Components Unauthenticated Remote Code Execution (CVE-2025-55182)

Multiple Node.js React Server Components packages are affected by an unauthenticated remote code execution vulnerability. The following Node.js packages and versions are affected: - react-server-dom-webpack 19.0, 19.1.0, 19.1.1, 19.2.0 - react-server-dom-parcel 19.0, 19.1.0, 19.1.1, 19.2.0 -...

MAL-2025-190984 Malicious code in parcel-plugin-asset-copier (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 344955077c61592ec46c29550b12878886b0b61f3a7c84e050d6d25756f60bf2 The package parcel-plugin-asset-copier was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199059

Malicious code in parcel-plugin-asset-copier npm...

Malicious code in parcel-plugin-asset-copier (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 344955077c61592ec46c29550b12878886b0b61f3a7c84e050d6d25756f60bf2 The package parcel-plugin-asset-copier was found to contain malicious code. Source: ghsa-malware...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

EUVD-2025-177321

Malicious code in parcel-planckscale-puppeteer-version npm...

EUVD-2025-179983

Malicious code in boson-apex-parcel-cybernetics npm...

EUVD-2025-177133

Malicious code in playwright-dotenv-parse-variables-parcel-less npm...

EUVD-2025-176430

Malicious code in sequelize-ophiuchus-parcel-procyon npm...

EUVD-2025-177281

Malicious code in pegasus-parcel-gravity-cassini npm...

EUVD-2025-178213

Malicious code in karma-spectron-parcel-aether npm...

EUVD-2025-179236

Malicious code in duplex-init-parcel-test npm...

EUVD-2025-179234

Malicious code in duplex-parcel-nodejs-membrane npm...

EUVD-2025-177324

Malicious code in parcel-non-blocking-bulma-chakra-ui npm...

EUVD-2025-179857

Malicious code in castor-singularitarianism-parcel-perseus npm...

EUVD-2025-179303

Malicious code in development-playwright-stratosphere-parcel npm...

Malicious code in halley-fusion-parcel-node-sass (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8896c11499cbc300839106a9d93de9e4a30426aa807e94d84e2508e01be58e20 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...