EUVD-2025-79528

Malicious code in conventionalcanidaez3n npm...

EUVD-2025-82369

Malicious code in conventionalchickadee0xrequest npm...

EUVD-2025-82368

Malicious code in conventionaldamselflyreplicateautomation npm...

EUVD-2025-64761

Malicious code in conventionalmeadowlarkz3n npm...

EUVD-2025-64760

Malicious code in conventionalmeerkatz3n npm...

EUVD-2025-64762

Malicious code in conventional-pink-weasel npm...

Malicious code in conventional_boar_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cc456632da1cf4efacfca6b818c7376a6c12af2afa42b9cce1aa69883b0ba2a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-55176

Malicious code in conventional-red-piranha npm...

Malicious code in conventional-red-piranha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 814aa4f0dfc74d0fefe9c5ac4ebfe61e0fc891e5368bc14191c2017623391dfb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-55178

Malicious code in conventional-emerald-hamster npm...

EUVD-2025-55175

Malicious code in conventional-yellow-octopus npm...

EUVD-2025-55179

Malicious code in conventional-coral-piranha npm...

EUVD-2025-55177

Malicious code in conventional-jade-pig npm...

Malicious code in conventional-coral-piranha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9594abe83e004cb8eaf79d29b2d47e8ad4d2fd601a175915fa3e479acf2cb4b1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-50484

Malicious code in conventionalsnakez3n npm...

EUVD-2024-53778

Malicious code in bioql PyPI...

CVE-2025-59433

Conventional Changelog generates changelogs and release notes from a project's commit messages and metadata. Prior to version 2.0.0, @conventional-changelog/git-client has an argument injection vulnerability. This vulnerability manifests with the library's getTags API, which allows extra paramete...

CVE-2025-59433 @conventional-changelog/git-client has an Argument Injection vulnerability

Conventional Changelog generates changelogs and release notes from a project's commit messages and metadata. Prior to version 2.0.0, @conventional-changelog/git-client has an argument injection vulnerability. This vulnerability manifests with the library's getTags API, which allows extra paramete...

@conventional-changelog/git-client has Argument Injection vulnerability

Background on exploitation This vulnerability manifests with the library's getTags API, which allows specifying extra parameters passed to the git log command. In another API by this library - getRawCommits there are secure practices taken to ensure that the extra parameter path is unable to inje...

Conventional Changelog 参数注入漏洞

Conventional Changelog is an open source update log generation tool from Conventional Changelog. A parameter injection vulnerability exists in Conventional Changelog versions prior to 2.0.0 that stems from not cleaning or validating user input in the getTags API, which could lead to a parameter...