EUVD-2025-175836

Malicious code in umbra-jekyll-foundation-graphql npm...

EUVD-2025-176240

Malicious code in sqlite-oauth-quito-graphql npm...

EUVD-2025-178676

Malicious code in graphql-nightmare-css-loader-abiogenesis npm...

Malicious code in miranda-markdown-pdf-rate-limiter-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e691ac26ae0b92394354fcda674316914c8f0464d09a7681898100fb4da7308 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187206 Malicious code in graphql-nightmare-css-loader-abiogenesis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 827a1eab8ee4f7a8518854247fd592f6a76ba721ba6900d144ce9f687b27a255 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-179343

Malicious code in dendrochronology-graphql-betelgeuse-acamar npm...

EUVD-2025-178677

Malicious code in graphql-karma-cluster-mongodb npm...

EUVD-2025-179480

Malicious code in cryptography-biohacking-xml-graphql npm...

EUVD-2025-178675

Malicious code in graphql-npm-soap-fermiparadox npm...

EUVD-2025-178932

Malicious code in fermion-graphql-dorado-lynx npm...

Cross-site Request Forgery (CSRF)

Apollo Studio Embeddable Explorer & Embeddable Sandbox are vulnerable to cross-site request forgery CSRF. The vulnerability is due to missing origin validation in the client-side handling of window.postMessage events, which allows an attacker to send forged messages that trigger arbitrary GraphQL...

EUVD-2025-122120

Malicious code in selenium-hapi-graphql-convict npm...

Malicious code in graphql-registry-sedna-configstore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43426488caa65ceaf277ae33df4839e7ebc26fd723dca2280a380133248433ec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in configstore-graphql-pm2-virgo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0df4450f2fb42c74059bdf2515b13d9ec227be42735da764c21f0c090c58f9c0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-113338

Malicious code in gacrux-nightwatch-nebula-graphql npm...

EUVD-2025-121032

Malicious code in ultra-graphql-xo-deimos npm...

EUVD-2025-113335

Malicious code in gacrux-phoebe-graphql-dagda npm...

EUVD-2025-122139

Malicious code in sedna-pegasus-graphql-jupiter npm...

EUVD-2025-114833

Malicious code in cross-env-yakutsk-octans-graphql npm...

Malicious code in altair-chai-transform-graphql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2e57b70246ceb72a49720b47e3ecfd3567bcccae73b01aba9d723cd8ba9b6bc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...