5925 matches found
MAL-2025-187207 Malicious code in graphql-npm-soap-fermiparadox (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56716e434cd1c5a44faa2761e4607685f3dc1bfd3de906c84be90f3ba243a05b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-177165
Malicious code in pino-pretty-yildun-express-graphql npm...
EUVD-2025-178126
Malicious code in less-loader-orbit-outercore-graphql npm...
EUVD-2025-179633
Malicious code in commitlint-config-angular-graphql-ursa-yakutsk npm...
EUVD-2025-178886
Malicious code in flare-ignite-graphql-eridanus npm...
EUVD-2025-179959
Malicious code in buffer-package-bionics-graphql npm...
EUVD-2025-175836
Malicious code in umbra-jekyll-foundation-graphql npm...
EUVD-2025-176240
Malicious code in sqlite-oauth-quito-graphql npm...
EUVD-2025-178677
Malicious code in graphql-karma-cluster-mongodb npm...
EUVD-2025-179480
Malicious code in cryptography-biohacking-xml-graphql npm...
EUVD-2025-179343
Malicious code in dendrochronology-graphql-betelgeuse-acamar npm...
EUVD-2025-178932
Malicious code in fermion-graphql-dorado-lynx npm...
EUVD-2025-178675
Malicious code in graphql-npm-soap-fermiparadox npm...
Cross-site Request Forgery (CSRF)
Apollo Studio Embeddable Explorer & Embeddable Sandbox are vulnerable to cross-site request forgery CSRF. The vulnerability is due to missing origin validation in the client-side handling of window.postMessage events, which allows an attacker to send forged messages that trigger arbitrary GraphQL...
EUVD-2025-120969
Malicious code in uninstall-inquirer-vega-graphql npm...
EUVD-2025-120507
Malicious code in websockets-graphql-regulus-canopus npm...
EUVD-2025-121630
Malicious code in stop-flare-graphql-webdriverio npm...
EUVD-2025-121270
Malicious code in thuban-oauth-graphql-colors npm...