GHSA-X7RP-QJ2H-GHGW Flowise Fails to Invalidate Existing Sessions After Password Changes

Summary Failure to Invalidate Existing Sessions After Password Change Persistent Session / Session Invalidity Failure. Details After a user changes their password, the application does not invalidate other active sessions or session tokens that were established before the change. An attacker who...

Malicious code in chain-test-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3e0c036eeb1631fbe88e6fc1c18dc89f31a900e1d528bd2027a2aef1eb35a60 The package chain-test-async was found to contain malicious code. Source: ghsa-malware c1d03d8b6de88ac68ebdd7ea00a039ed4f3d071cda41ca8e038c5cad8eb212...

Malicious code in vite-chunk-master (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fa857f9f07f371efc55f392a0fcf81beea9480a42476b38fe80cf496b37ba8d The package vite-chunk-master was found to contain malicious code. Source: ghsa-malware...

MAL-2025-154673 Malicious code in dioago-kamo-ala (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3371a361974d6baba10d18340abf8a98d2837a7f942f44f9a6d52fee3b0f083f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nodejs-cygnus-sync-markdown-pdf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83ce14a4ddd7e7d11d764543dc23faf3d5934fb6001941a7c607b55b5975b389 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146019 Malicious code in pegasus-callback-build-sequelize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa451bc61732e3800480939f0e2c59aacea12ed0549347ad33424411dbe39b55 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-98722 Malicious code in frantic_slug_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c904b9ebcda8835c3296a759911689c3207d8550a4c0ca63a8b9fd5e3fc7c9ac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-76659 Malicious code in rulesdir (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c805fe99761f008f2684b4317d760d59a99462becf37b554d6673444045ae3fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-66551 Malicious code in tensor-fi-utils-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5e019daea1bdfd44c0cf583f38cd83ec5b2073b8b494e8ff91905e0b2f2f88e The package tensor-fi-utils-lib was found to contain malicious code. Source: ghsa-malware...

MAL-2025-66550 Malicious code in szsec-infos-report (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0f7d0f83d7810b53b86603e822f34d4b2829f2f0ee8853839340239d99b8388 The package szsec-infos-report was found to contain malicious code. Source: ghsa-malware...

MAL-2025-66543 Malicious code in @walletwave/ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15e6b9673bf6056f0f870d3aa6ad6c4e83ef1a3bf3b58a601dc9cae80d673390 The package @walletwave/ui was found to contain malicious code. Source: ghsa-malware 42ec23f1a72e982a80ced819057ca03a0d26999dc6b7417343456de67a35ec46...

MAL-2025-55021 Malicious code in web-vitals-help (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 204b3a82026288b65a149e983d855812d21ccc8c61952dcb037c926c2b3a3452 The package web-vitals-help was found to contain malicious code. Source: ghsa-malware 93e30ad20be59206c5d91e0d2bff19f6c6969c69dc3ebc477ae0c980cc3d242...

Malicious code in @mts-ds/icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0112c17ea22a1384f1973813b785859e61805e29b2027b835dfa81c022bd846e The package @mts-ds/icons was found to contain malicious code. Source: ghsa-malware b51afa604dd61e1408dc95f628c00b6b379d7191214d2b77258a2a97f0cb38e4...

Malicious code in huangming-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53612bb1244997357931275dea1924a477215c7db7ab8297f2fead735926859e The package huangming-demo was found to contain malicious code. Source: ghsa-malware 503c69173f37b1e6d7f159b77bb5f5a3bb677dff293fb44f2a09038a31172fdb...

MAL-2025-49388 Malicious code in xss-payload-all (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c825aada16e0da858a5e9f4b836a1c7a9e4b6e2727d285ff60e8634deb99848 The package xss-payload-all was found to contain malicious code. Source: ghsa-malware bf42864a16e802aec4ff8ec23d71f82c73ac809e44e56a55bcec163b05f539a...

Malicious code in @chatclub/claude-code (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6acfccb78a615c7f037fe5dbd1001d9a77ca4015c89c94122ba5dd78978b66b The package @chatclub/claude-code was found to contain malicious code. Source: ghsa-malware...

MAL-2025-49368 Malicious code in react-tmedia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2561617d960be4ee063460a87fe4cded553ec3c3f0258fcaae75a27aa92de3b The package react-tmedia was found to contain malicious code. Source: ghsa-malware eb8db46193d662b789371d3c7670652c9d9dca288f0b99daba2791a3410613cf A...

Malicious code in tailwindcss-setgrids (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6cf6bb0e9fdf4dacf7dcecfc3cf72eacedce92607c3e18ca8a6ea02c618b9a5 The package tailwindcss-setgrids was found to contain malicious code. Source: ghsa-malware...

MAL-2025-49367 Malicious code in monobing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 441b7951912d3fb98c9e3b96bbb2d93b7a99c024e860f3424d3f09befcb1c3c9 The package monobing was found to contain malicious code. Source: ghsa-malware 387a8c28d992f25a42764f6d247a0c1c0a70119f99f570f157549646628995e6 Any...

MAL-2025-49366 Malicious code in mojio-client-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fea28b1c502ade1afb436a22ffc2bd83e1c413dd85b274370f805ec0760be91 The package mojio-client-lite was found to contain malicious code. Source: ghsa-malware...