6798 matches found
CVE-2025-64752 grist-core has path to server-side requests via websocket
grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with access to any document on a Grist installation can use a feature for fetching from a URL that is executed on the server. The privileged network access of server-side requests could offer opportunities for attack...
EUVD-2025-177190
grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with access to any document on a Grist installation can use a feature for fetching from a URL that is executed on the server. The privileged network access of server-side requests could offer opportunities for attack...
Malicious code in miranda-koa-fetch-duplex (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0542faa9fd01fa72c958cf46a1d5a08f0ba4db727709a088052187230321c063 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-180328
Malicious code in ariel-geckodriver-stratosphere-fetch npm...
EUVD-2025-180511
Malicious code in accretion-avior-radiometric-fetch npm...
EUVD-2025-178504
Malicious code in html-webpack-plugin-vega-atlas-fetch npm...
Malicious code in html-webpack-plugin-vega-atlas-fetch (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72fd14fbfa7df3518df196ac7331d4c07644a19e457f73f31be91ee9ab01ce42 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in odin-fetch-arcturus-cressida (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 944cc38dea4fc36d654dc11a150cb42c931cbc0e0ca281f0140ac9026cc65516 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in epimetheus-release-it-fetch-centaurus (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc286cddc9b68a29d158425dc814ed9cc8de7a7cdd3c89822a899de1ace22dd7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-177807
Malicious code in miranda-koa-fetch-duplex npm...
EUVD-2025-175536
Malicious code in winston-process-fetch-server npm...
Malicious code in xanadu-singularitarianism-fetch-fermion (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ccd63704a8837ed8bae59ef565a17f740167e4fc9a2bbf7f4164bc2321af13b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-175758
Malicious code in ursa-rest-fetch-thermochronology npm...
MAL-2025-190340 Malicious code in winston-process-fetch-server (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f32310e6d14f06422f625862322cf64c1e6a08c795148c10b8a5c50e384c2f17 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-187778 Malicious code in library-fetch-hyperion-vortex (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca2c4eff15bede06787b56a8f8b27dea6ef1f37f7ce1a8ee13de06cce88a6df5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-178090
Malicious code in link-leda-odin-fetch npm...
EUVD-2025-178925
Malicious code in fetch-blackhole-framework-apollo npm...
Malicious code in fetch-charon-callisto-meissa (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62550fec98515505f3376660a176a2b13482b88711b0022c9925a9b825e4fb36 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in command-leda-fetch-delphinus (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5feb6e2ef6c9afe8aa0d51f1a5b382e86c7f05202802ce99f9d5296a1ce376d1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...