Malicious code in running-turquoise-gorilla (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cd8c4a52932374eae72b8041de8a87eddd7c44e47042f92aff28c55a430b78d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-52203

Malicious code in running-turquoise-gorilla npm...

EUVD-2025-55760

Malicious code in available-moccasin-gorilla npm...

MAL-2025-66922 Malicious code in balanced-olive-gorilla (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bda32b6b9a46b6e3213c56f57352524c27e4a09f57e09f897c24e26ccf74d45f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-49637

Malicious code in plasticgorillaz3n npm...

EUVD-2025-49179

Malicious code in toughgorillaz3n npm...

EUVD-2025-46171

Malicious code in newgorillaz3n npm...

EUVD-2025-47697

Malicious code in fastgorillaz3n npm...

EUVD-2014-5098

Malware in sbrugna...

EUVD-2021-29362

Malicious code in bioql PyPI...

EUVD-2023-52744

Malicious code in bioql PyPI...

EUVD-2025-26212

Malicious code in bioql PyPI...

EUVD-2024-2233

Malicious code in bioql PyPI...

EUVD-2025-10883

Malicious code in bioql PyPI...

Malicious code in fjord-gorilla-ciz332-project (npm)

The package fjord-gorilla-ciz332-project was found to contain malicious code...

MAL-2025-44279 Malicious code in fjord-gorilla-ciz332-project (npm)

The package fjord-gorilla-ciz332-project was found to contain malicious code...

SUSE CVE-2025-47909

Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks. After the CVE-2025-24358 fix, a network attacker that places a form at http://example.com can't get it to submit to https://example.com because the Origin...

GHSA-82FF-HG59-8X73 github.com/gorilla/csrf improperly validates TrustedOrigins allowing CSRF attacks

Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks. After the CVE-2025-24358 fix, a network attacker that places a form at http://example.com can't get it to submit to https://example.com because the Origin...

github.com/gorilla/csrf improperly validates TrustedOrigins allowing CSRF attacks

Hosts listed in TrustedOrigins implicitly allow requests from the corresponding HTTP origins, allowing network MitMs to perform CSRF attacks. After the CVE-2025-24358 fix, a network attacker that places a form at http://example.com can't get it to submit to https://example.com because the Origin...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF due to improper validation of the TrustedOrigins header which was introduced by the fix for CVE-2025-24358. An attacker can perform unauthorized actions on behalf of authenticated users by submitting...