622 matches found
EUVD-2025-121456
Malicious code in taurus-mdx-promise-browserify npm...
MAL-2025-144853 Malicious code in mensa-global-promise-upgrade (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12c94e7b9cf8e7ef681f2d8b9d20af61cfbb0ab1bd542dbba0f84d592e384c12 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-112273
Malicious code in janus-webdriver-manager-promise-aquarius npm...
EUVD-2025-114405
Malicious code in dotenv-cosmos-promise-css-minimizer-webpack-plugin npm...
EUVD-2025-123271
Malicious code in promise-subscription-pipe-bellatrix npm...
MAL-2025-141084 Malicious code in convict-promise-transform-weywot (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a773ff24f12fd9deed0f9b0e82fb801841739a9bc9a21b854986738c1090633 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-144825 Malicious code in meissa-pipe-dependencies-promise (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46d83ca74cc580cbd8d76790318201e0cdecf41986d97cbcec98d9b091d4ea57 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-143071 Malicious code in grunt-promise-vuetify-middleware (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b7391023fb97db27e60952bee597e73cca8d4958978321dea8fc85e8695ad64 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-146647 Malicious code in promise-registry-bellatrix-element-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab1a5c501ec3299dcc8dfa9935e0f26ed824255bb5062b9cb5ddfe62fbd4f34c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-36857
Malicious code in no-floating-promise npm...
Malicious code in no-floating-promise (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06870b1f839041e943ec19a9c8930d03b27e9fdfef7f3b79fe0eff1545dec2ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Use After Free
Overview Affected versions of this package are vulnerable to Use After Free in the jsstdpromiserejectioncheck function when iterating over the rejectedpromiselist. An attacker can achieve arbitrary code execution or cause a crash by supplying a malicious Error object with a custom property getter...
UBUNTU-CVE-2025-62491
A Use-After-Free UAF vulnerability exists in the QuickJS engine's standard library when iterating over the global list of unhandled rejected promises ts-rejectedpromiselist. The function jsstdpromiserejectioncheck attempts to iterate over the rejectedpromiselist to report unhandled rejections usi...
CVE-2025-62491 Use-after-free in js_std_promise_rejection_check in QuickJS
A Use-After-Free UAF vulnerability exists in the QuickJS engine's standard library when iterating over the global list of unhandled rejected promises ts-rejectedpromiselist. The function jsstdpromiserejectioncheck attempts to iterate over the rejectedpromiselist to report unhandled rejections usi...
Malicious code in vite-babel-plugin-es6-promise (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19412e443845747fa7d9b029fb4b869a17e57e3fc01783407a17684f0e1ad1d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-48322 Malicious code in vite-babel-plugin-es6-promise (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19412e443845747fa7d9b029fb4b869a17e57e3fc01783407a17684f0e1ad1d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
EUVD-2018-18350
Malware in sbrugna...
EUVD-2025-18190
Malicious code in bioql PyPI...