EUVD-2025-121666

Malicious code in standard-schema-ophiuchus-cors npm...

EUVD-2025-112893

Malicious code in heka-tool-fornax-schema npm...

EUVD-2025-122234

Malicious code in schema-arcturus-relay-hugo npm...

EUVD-2025-122231

Malicious code in schema-dione-meissa-kronos npm...

EUVD-2025-114730

Malicious code in cygnus-schema-pino-playwright npm...

EUVD-2025-114752

Malicious code in csv-schema-alphard-taurus npm...

EUVD-2025-113237

Malicious code in geckodriver-miranda-mongodb-schema npm...

EUVD-2025-120484

Malicious code in weywot-schema-relay-warp npm...

EUVD-2025-122224

Malicious code in schema-semantic-release-andromeda-celeste npm...

Malicious code in proxima-helmet-schema-rollup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c995599cbe52eeb9442e68f9fe9ff41d1f1b8074946fbb0b96de6f120630700 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140034 Malicious code in blaze-uglify-js-schema-subscription (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f8d5f1ce6793923e6a5f433e28c137a347dd3e3071b1cfcf658b2ec25fcd7b7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144778 Malicious code in mdx-schema-chai-foundation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62e20418c5cc5d9a5995fe03f673118b061c32c2def8904ddb0f8507709f4343 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140729 Malicious code in charon-pegasus-jsonp-schema (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82efbf0050b8e5d9394494a4d5e819a5bc550e287d785c51d7699688618a277f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142866 Malicious code in geckodriver-hyperion-aurora-schema (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 298930ea874b7fae8089492be4a1a76825be6ba2b6aee39441fea337706f9213 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-149634 Malicious code in xanthus-polaris-schema-mui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d601c2e8fa6c9ff5c441fca9727006e3f2ba484a9a64e97eaf9b4ffb221358a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-139840 Malicious code in axios-taurus-dependencies-schema (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 965c88890449fe70ebace8f5d70434f7e73124448645e16a637c60e57170d328 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

ThinkDashboard Cross-Site Scripting Vulnerability

ThinkDashboard is a lightweight, self-hosted bookmarking dashboard. A cross-site scripting vulnerability exists in ThinkDashboard version 0.6.7 and earlier, which stems from a lack of schema filtering and can be exploited by an attacker to cause a stored cross-site scripting attack...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the WriteRelationships function when the exclusion operator is used in the authorization schema and the server is configured with --write-relationships-max-updates-per-call greater...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the WriteRelationships function when the exclusion operator is used in the authorization schema and the server is configured with --write-relationships-max-updates-per-call greater...

CVE-2025-64502

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. The MongoDB explain method provides detailed information about query execution plans, including index usage, collection scanning behavior, and performance metrics. Prior to version 8.5.0-alpha....