17292 matches found
CVE-2025-64756 glob CLI: Command injection via -c/--cmd executes matches with shell:true
Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c are...
@omni-co/vega-lite (>=6.2.0-fork.2, <=6.2.0-fork.2-beta.2), arakawa (0.1.0-alpha.1) +3 more potentially affected by CVE-2025-59840 via vega-expression (6.0.0)
vega-expression NPM version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on vega-expression and may be impacted: - @omni-co/vega-lite =6.2.0-fork.2, =6.0.0, =6.0.0, =6.0.0, =6.3.1 Source cves: CVE-2025-59840 Source advisory: GHSA-7F2V-3QQ3-VVJF...
arakawa (0.1.0-alpha.1), vega-cli (>=6.0.0, <=6.1.2) potentially affected by CVE-2025-59840 via vega (>=6.0.0, <=6.1.2)
vega NPM version =6.0.0, =6.0.0, =6.1.2 Source cves: CVE-2025-59840 Source advisory: OSV:GHSA-7F2V-3QQ3-VVJF...
@omni-co/vega-lite (>=6.2.0-fork.2, <=6.2.0-fork.2-beta.2), arakawa (0.1.0-alpha.1) +3 more potentially affected by CVE-2025-59840 via vega-expression (6.0.0)
vega-expression NPM version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on vega-expression and may be impacted: - @omni-co/vega-lite =6.2.0-fork.2, =6.0.0, =6.0.0, =6.0.0, =6.3.1 Source cves: CVE-2025-59840 Source advisory:...
arakawa (0.1.0-alpha.1), vega-cli (>=6.0.0, <=6.1.2) potentially affected by CVE-2025-59840 via vega (>=6.0.0, <=6.1.2)
vega NPM version =6.0.0, =6.0.0, =6.1.2 Source cves: CVE-2025-59840 Source advisory: SNYK:JS-VEGA-13961123...
EUVD-2025-177865
Malicious code in meteor-cli-nightwatch-test npm...
Malicious code in centauri-cli-transport-selenium (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd6ea24fbeeee105ca193a62e5857465b996bac0d4c5b8f72086246e1f61c665 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in hyperion-terraforming-cli-callback (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 139f22bb319881877ea250018776f20d2290205a8ea094dd1c1fc3e84dc1083a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in meteor-cli-nightwatch-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4ae5ae48dc55180eb76cf505e37d133d5e836a3f4246eaf1b4fdf5e063f5a2f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in resolvers-heliophysics-apollo-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60103abfcaa8fc26071abc38c8d81f1d5bd8f1c7ce82c117b98ee3f28734ac7c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in sadr-dactyl-xenon-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db46a51c94a6c001ca87f74104924bd66b9a1470fc9625f9b6c2f34acf9295b2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in transhumanism-cli-superflare-hermes (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 039599f02d93393fef55555c47eded87dcb54d3570cdbcd5cf54955e04f9479b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-189221 Malicious code in restart-virtualreality-cli-spectron (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9d5aa5bdd04a69e784a9117629e602322a901b83eca9fc9f548929ac2cf681d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-186164 Malicious code in cli-eris-cors-jest (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e21ccc4b2c62bf4c996a5e3973550804784a618256801ff24d7af79770a5a6c5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-189303 Malicious code in sadr-dactyl-xenon-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db46a51c94a6c001ca87f74104924bd66b9a1470fc9625f9b6c2f34acf9295b2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-189158 Malicious code in relay-tardigrade-typeorm-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68e65873a2865720e808f1d146398547f6af6787ab402144f49958f3ae3b6e90 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-176216
Malicious code in start-iota-webpack-cli npm...
EUVD-2025-177395
Malicious code in outercore-cli-concurrently-troposphere npm...