Longitudinal Analyses of SAST Tools: A CodeQL Case Study

Open-source software OSS pipelines rely on automated static analysis tools to prevent the introduction of vulnerabilities in code. However, there is limited understanding of the efficacy of these tools across the OSS ecosystem over time. In this paper, we introduce a novel method to evaluate stat...

CVE-2025-64753

grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document could still access endpoints listing hashes for versions of that document and receive a full list of changes between versions, even if those changes contained cells, columns, or...

Malicious code in lithosphere-pegasus-jest-paleoecology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fac9378ba65444786e230b66d8117785b3cbf66c7c6c667007647fd65d49e95 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in airbnb-australis-inflation-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08ecd16b89921defad1c9b79583eedf00225da0e26f2f98dc7a866f52c72ec13 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in node-config-hexo-version-indus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e9b65b9b8c11b124be12acd58301b389aedba3ac28ad6ab66fcf6f4ac2a0a2c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in phi-private-async-earth-xi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b930c14e745c4ce4165a894796d9879c130ecb462db863194881e2488a88548 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in prettier-meteor-mineralogy-vuepress (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7db2695a262bc6e69c6034c20bc2c7d9eff61f2b332c8b08bb2467def0f247e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sagitta-whitedwarf-betelgeuse-plutology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2787349d2a0b1c5c6c6c213c0c755d72dd5c786eff681299c936ceca5da3a44 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in convict-writable-webpack-cosmogenic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d97564ab9fc4db43f4230b9d93ccc412d62ff1b73b25e6ee7eeca8c3f4298df7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in perseus-astrobiology-xo-postgres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 209bc773fd8267be72905b2255aec7ca34c777cb43cffc9a378f21758053dd22 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in commitlint-config-angular-hercules-express-yonder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ddef34412e83c0fbe8a9644690f235972b287dd6c6f27c8589726648b3334e1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in run-script-juno-supernova-commitlint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28d5416570aa5bf98628db20b38d6aa688ee1a11743013f75bbbf34b033fb219 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in meissa-pavo-asthenosphere-aurora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c245ebc6d662cd2d791c2a665a08b64c0ac325a3faea4ed570146f511d921147 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lyra-fomalhaut-arcturus-enceladus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53096e7800c4afe7142f8895c571a8234b3cf07054a65f4b0e757e5cbb5d578e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in astrometry-kaus-on-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 469c28639b258e0ec9481cddd807a104ea8e6e67e6450680bedad1a799ee103e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in chai-prompts-auth0-geckodriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad324c4ea61642de7103f9b9dd8dbcd82c0039694bf830c253f7ff3fe81db1ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in proteomics-zenobia-cosmology-quark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a4e7d5ae13c3d2ff1ead466a88401fa90829d62ed12d16ab27ae9c89d0f3bad This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in colors-request-xo-xerxes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1498b0185b55cab24bef95e606502bbbd2afbfe23c40d14a9b5f91cec7b05faf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in joviology-exobiology-antares-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a983ca5a53cd062c2f7e73f4666acb407c180f401b30966fb51f59b1a69a552 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in helmet-pegasus-non-blocking-phoebe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14468cf08644b774f382415ed7ea9da2eca47006b532d6e5389e4ad5a9f45130 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...