Longitudinal Analyses of SAST Tools: A CodeQL Case Study

Open-source software OSS pipelines rely on automated static analysis tools to prevent the introduction of vulnerabilities in code. However, there is limited understanding of the efficacy of these tools across the OSS ecosystem over time. In this paper, we introduce a novel method to evaluate stat...

CVE-2025-64753

grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document could still access endpoints listing hashes for versions of that document and receive a full list of changes between versions, even if those changes contained cells, columns, or...

Malicious code in comet-oauth-airbnb-tethys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d9fb8279f61223224e9fbdc329b569ad93d0e71610a041f12d1cb85156c9a10 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nightwatch-global-subduction-eslint-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6db5dca0a960c4affb7ee077ac8b2613cfe86d64f6224a89a259c25d733fcdf0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phi-void-long-reject-import (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0575ba7190f457149e600c3f495b41bf3da1f88c362f42da78e7ded6e0d2b470 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in csv-puppeteer-phoenix-event (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 374bf3eeca6aa7f97f05cedd4268ceca21f16e8c36c450cb4fa2c17ac2ffd1ab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nashira-winston-aurora-gatsby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9af5c52e6cf6987260607279112d0d054adf72f69bd5cad9cc62fec8cf109c67 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in upsilon-fast-epsilon-optimize-interface (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d653fcaa0c2e1a74b8bf8126b95ed3b9284be21d307f766a0df8c77a468db28 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prettier-plugin-markdown-lint-jest-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4732bbd796f8b60aa6eaaab2fad1af9c69bb1acc6c805e0ccc202d281754d20 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in index-gamma-authorize-deploy-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 855a93e5306676df25469d50536f602165b1a8e5b59b3116fe63ffd6dba16314 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in umbra-jekyll-foundation-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c106822cf8e3fa26d502751c57e0f20c137335a06eaa078c6724cb7fa72d9938 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in commitlint-config-angular-nodejs-carpo-vortex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aff6171864c8dd888f734cabf61ae22f26f3868044dd59eb396032310cdbcf72 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in convict-writable-webpack-cosmogenic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d97564ab9fc4db43f4230b9d93ccc412d62ff1b73b25e6ee7eeca8c3f4298df7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phi-private-async-earth-xi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b930c14e745c4ce4165a894796d9879c130ecb462db863194881e2488a88548 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wavefunction-procyon-archaeoastronomy-uranology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d827178311a22de7b56e9e1c381516b8c0e5313a960ee72e8474c15d154b6e51 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in registry-ursa-prettier-plugin-markdown-framework (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bce70a60b982911ae8463ded8b5a8cfc5578f573075e24291265f231dd7d8f9a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in heka-markdownlint-rollup-node-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3918091bf1dccaa7a82585cf98bba21f487de7dad3e092c4d5f4c7b1b3c7e9ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in redgiant-nightwatch-filament-mensa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ed00d409000e536d8b0c2ac90de69f26c89dd68b20849ea28301e0b7896a5aa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in janus-rocket-crust-xerxes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57d68df4dd0ef3941fc01f5427a525386ddef1adb2f0de27c41bda77a6971c9f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ganymede-volcanology-meteor-andromeda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 439f5aeded04421261b5e44959256e95a019859e49ea507d43c2521ec92cdfb9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...