Malicious code in umbra-iota-graphql-callback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0216011a857c745443a164b8b961b2825a42498fd66c95b1ea56899885b894bd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-178886

Malicious code in flare-ignite-graphql-eridanus npm...

EUVD-2025-177165

Malicious code in pino-pretty-yildun-express-graphql npm...

Malicious code in miranda-markdown-pdf-rate-limiter-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e691ac26ae0b92394354fcda674316914c8f0464d09a7681898100fb4da7308 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-179959

Malicious code in buffer-package-bionics-graphql npm...

EUVD-2025-179633

Malicious code in commitlint-config-angular-graphql-ursa-yakutsk npm...

EUVD-2025-175836

Malicious code in umbra-jekyll-foundation-graphql npm...

EUVD-2025-176240

Malicious code in sqlite-oauth-quito-graphql npm...

MAL-2025-187207 Malicious code in graphql-npm-soap-fermiparadox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56716e434cd1c5a44faa2761e4607685f3dc1bfd3de906c84be90f3ba243a05b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187206 Malicious code in graphql-nightmare-css-loader-abiogenesis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 827a1eab8ee4f7a8518854247fd592f6a76ba721ba6900d144ce9f687b27a255 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-178677

Malicious code in graphql-karma-cluster-mongodb npm...

EUVD-2025-178675

Malicious code in graphql-npm-soap-fermiparadox npm...

EUVD-2025-179480

Malicious code in cryptography-biohacking-xml-graphql npm...

EUVD-2025-179343

Malicious code in dendrochronology-graphql-betelgeuse-acamar npm...

EUVD-2025-178932

Malicious code in fermion-graphql-dorado-lynx npm...

Cross-site Request Forgery (CSRF)

Apollo Studio Embeddable Explorer & Embeddable Sandbox are vulnerable to cross-site request forgery CSRF. The vulnerability is due to missing origin validation in the client-side handling of window.postMessage events, which allows an attacker to send forged messages that trigger arbitrary GraphQL...

EUVD-2025-122120

Malicious code in selenium-hapi-graphql-convict npm...

Malicious code in graphql-registry-sedna-configstore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43426488caa65ceaf277ae33df4839e7ebc26fd723dca2280a380133248433ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-116757

Malicious code in altair-airbnb-graphql-transform npm...

Malicious code in configstore-graphql-pm2-virgo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0df4450f2fb42c74059bdf2515b13d9ec227be42735da764c21f0c090c58f9c0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...