EUVD-2025-176714

Malicious code in release-it-apollo-norma-vuepress npm...

MAL-2025-186331 Malicious code in cosmiconfig-perseus-redgiant-apollo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8cabf74a61f50af9ee6fb8098d25d2c08526d5b73a3c74ec59e714ad4cb37b6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-180381

Malicious code in apollo-sirius-upgrade-iota npm...

MAL-2025-187118 Malicious code in gatsby-apollo-sync-lyra (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee47692086d9bcafefec2a4f2f2b13221504e62731ca39a928a5cdf8089dd14a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-180388

Malicious code in apollo-dotenv-parse-variables-stratigraphy-private npm...

EUVD-2025-179296

Malicious code in dione-dorado-apollo-mongodb npm...

MAL-2025-187175 Malicious code in global-apollo-dysonswarm-nebula (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8624af2234afa89e899457b5b5c227d1c1b09212d1eb8b2a207d466c14a8b2e8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189583 Malicious code in solarnebula-betelgeuse-mui-apollo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d8de60c105978945920dc38697ecb14795c8f5a537a62627e59ecee7595ac8e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in baryon-helmet-apollo-meteor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e509619c8cda9fd9f1db9cb20bb317bddf00e771bcc44d0c746b082e3da2e4b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187025 Malicious code in fork-winston-apollo-yaml (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35c38fb3b8dce0d51fe097f114d49539610b5038bc08488ececd68bce2f3e0fb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188271 Malicious code in nextjs-tachyon-apollo-cosmos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5808e78b34136ebba63563f7cd291a9023ea14a6a89294689d6a76ff25855793 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-180425

Malicious code in antares-bunyan-apollo-deimos npm...

Apollo Federation 安全漏洞

Apollo Federation is an architecture for the Apollo community to declaratively combine APIs into a unified graph. A security vulnerability exists in Apollo Federation versions prior to 2.9.5, prior to 2.10.4, prior to 2.11.5, and prior to 2.12.1, which stems from a flaw in the combination logic...

CVE-2025-64530: Authentication Bypass Using an Alternate Path or Channel

Apollo Federation is an architecture for declaratively composing APIs into a unified graph. A vulnerability in versions of Apollo Federation's composition logic prior to 2.9.5, 2.10.4, 2.11.5, and 2.12.1 allowed some queries to Apollo Router to improperly bypass access controls on types/fields...

PT-2025-46925

Name of the Vulnerable Software and Affected Versions Apollo Federation versions prior to 2.9.5 Apollo Federation versions prior to 2.10.4 Apollo Federation versions prior to 2.11.5 Apollo Federation versions prior to 2.12.1 Description Apollo Federation is an architecture for composing APIs into...

EUVD-2025-116577

Malicious code in apollo-rate-limiter-hermes-atlas npm...

EUVD-2025-121577

Malicious code in subscription-apollo-hermes-spawn npm...

Malicious code in sedna-nightmare-global-apollo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eea5f9d9f5413f180107a6de4e14c1bf8cfb6eb40e53c220812579cb7b81df7d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-116611

Malicious code in apollo-aldebaran-restart-xanthus npm...

Malicious code in regulus-geckodriver-apollo-ignite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d86803956b94c8ff513b4ef9bea65fe82c6737e4b0244a4e7a7456162559bd4b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...