Malicious code in altair-airbnb-graphql-transform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c76d50832dc7ab98677387bda1e24e8e43a74397e6dc03c9b59ea52ff4393cb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-121282

Malicious code in thuban-delphinus-rollup-plugin-graphql npm...

EUVD-2025-115300

Malicious code in cli-quantum-graphql-phoebe npm...

Malicious code in process-mysql-graphql-achernar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce30421baf221f5039852b56fa71beb90736340eb15021cdb3e1155efa5bad6c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-113113

Malicious code in graphql-charon-element-ui-iota npm...

EUVD-2025-112001

Malicious code in karma-kronos-protractor-graphql npm...

EUVD-2025-113102

Malicious code in graphql-transport-umbriel-mini-css-extract-plugin npm...

MAL-2025-146031 Malicious code in pegasus-graphql-playwright-husky (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9485849dcf43ce232720e15f229be2925398be484ea117e2cc67c5e107784b5e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-115055

Malicious code in configstore-graphql-pm2-virgo npm...

EUVD-2025-113118

Malicious code in graphql-altair-antares-juno npm...

Malicious code in pegasus-graphql-playwright-husky (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9485849dcf43ce232720e15f229be2925398be484ea117e2cc67c5e107784b5e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-112970

Malicious code in halley-graphql-europa-eridanus npm...

EUVD-2025-123890

Malicious code in pegasus-graphql-playwright-husky npm...

EUVD-2025-113099

Malicious code in graphql-vuepress-husky-bellatrix npm...

EUVD-2025-121607

Malicious code in stream-graphql-levels-sedna npm...

EUVD-2025-122109

Malicious code in selenium-spawn-graphql-scripts npm...

EUVD-2025-116783

Malicious code in alphard-cassini-graphql-warp npm...

Gitlab -- vulnerabilities

Gitlab reports: Cross-site scripting issue in k8s proxy impacts GitLab CE/EE Incorrect Authorization issue in workflows impacts GitLab EE Information Disclosure issue in GraphQL subscriptions impacts GitLab CE/EE Information Disclosure issue in access control impacts GitLab CE/EE Prompt Injection...

PT-2025-47050

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 16.7 through 18.3.6 GitLab CE/EE versions 18.4 through 18.4.4 GitLab CE/EE versions 18.5 through 18.5.2 Description A flaw exists in GitLab CE/EE that could allow a blocked user to access sensitive information. This is...

CVE-2025-64493

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. In versions 8.6.0 through 8.9.0, there is an authenticated, blind time-based SQL-injection inside the appMetadata-operation of the GraphQL-API. This allows extraction of arbitrary data from the...