CVE-2025-64709

Typebot (open-source chatbot builder) contains an SSRF flaw in the webhook block’s HTTP Request component affecting versions before 3.13.1. The issue lets authenticated users cause server-side HTTP requests, bypass IMDSv2 via custom header injection, and extract temporary AWS IAM credentials for ...

EUVD-2025-178495

Malicious code in hugo-plutology-comet-cluster npm...

EUVD-2025-178798

Malicious code in gacrux-magellan-cluster-version npm...

EUVD-2025-179690

Malicious code in cluster-wind-fork-view-monitor npm...

EUVD-2025-179699

Malicious code in cluster-protected-resolve-cloud-refactor npm...

EUVD-2025-176000

Malicious code in terser-webpack-plugin-nestjs-umbriel-cluster npm...

EUVD-2025-179680

Malicious code in cold-phi-cloud-cluster-private npm...

EUVD-2025-179787

Malicious code in chalk-cluster-nucleosynthesis-pipe npm...

EUVD-2025-179629

Malicious code in commitlint-config-angular-sadr-cluster-mira npm...

EUVD-2025-179697

Malicious code in cluster-simple-encrypt-cloud-balance npm...

EUVD-2025-177424

Malicious code in optimize-theta-process-cluster-dog npm...

EUVD-2025-178288

Malicious code in java-socket-cluster-decode-catch npm...

EUVD-2025-176381

Malicious code in signal-authenticate-cluster-await-byte npm...

Malicious code in terser-webpack-plugin-nestjs-umbriel-cluster (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce5383d1d73e04c37c0a2d6b250a999810d40f5479e51250c1e31ccd8bde1485 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186493 Malicious code in data-virtualize-cluster-view-phi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 936ecc613606a259a3d77f4c7386303bb0f2eed7f53fc811c049c825c25778a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189429 Malicious code in selenium-cluster-framework-eleventy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 945e3261b632eb6a730ff1c7db5709620010f8bf20bb163023ccd934c64a084f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-190097 Malicious code in upsilon-socket-cluster-static-eta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99c4127e8b9df2359bf4f313e20808bc22f8a6248af19bb410a6350869034d86 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cluster-tool-quasarjet-meteor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77d3dfb3f3920e3a072a4e1193a85adde9b2af5801f438ea99da4553b52e6154 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-180424

Malicious code in antares-cluster-ursa-javascript npm...

Malicious code in spectron-config-cluster-command (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c08d2d65c76806d436719434d7d31a3a7cc5dff6a3363f1907238d50aa0e630 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...