md-to-pdf vulnerable to arbitrary JavaScript code execution when parsing front matter

Summary A Markdown front-matter block that contains JavaScript delimiter causes the JS engine in gray-matter library to execute arbitrary code in the Markdown to PDF converter process of md-to-pdf library, resulting in remote code execution. Details md-to-pdf uses the gray-matter library to parse...

OSV-2025-906 Use-of-uninitialized-value in QImage::pixel

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=461199967 Crash type: Use-of-uninitialized-value Crash state: QImage::pixel XCFImageFormat::copyGrayAToRGB XCFImageFormat::copyLayerToImage...

EUVD-2025-120013

Malicious code in sillywhippetgray-50 npm...

Malicious code in victorious-gray-stingray (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8db8ed4892456becbc29f75ca434b652639869fa93ca9660a234ff93e9284f8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-117522

Malicious code in active-gray-dolphin npm...

Malicious code in obliged-gray-donkey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b04fe894ddc20327b2fb3e7036c84fe23114a4183385c745608ac91feb4a2778 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-117420

Malicious code in elated-gray-marten npm...

Malicious code in elated-gray-marten (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c32a771f61d8884dd839eb457a9126fe4d205325bf194b113122900c6b8a5cf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-117018

Malicious code in ugliest-gray-wallaby npm...

Malicious code in elderly-gray-spoonbill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96b959c5c17ab2c8ba4b992d3d10b18349b5b9d3e8a7f7a4fc3134853c0959c1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-117031

Malicious code in then-gray-smelt npm...

EUVD-2025-117467

Malicious code in cooing-gray-eagle npm...

EUVD-2025-117419

Malicious code in elderly-gray-spoonbill npm...

EUVD-2025-117003

Malicious code in victorious-gray-stingray npm...

EUVD-2025-117133

Malicious code in reduced-gray-chickadee npm...

EUVD-2025-117198

Malicious code in obliged-gray-donkey npm...

MAL-2025-138635 Malicious code in cooing-gray-eagle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee4e04041645ccefea1a7b4557022e36c1affbe69091836280e14d0184b2b7a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-74850

Malicious code in brainyoctopusgray-33 npm...

MAL-2025-111702 Malicious code in brainy_octopus_gray-33 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 420f7e1e19a0bb59666af86b1337b6aa3f58b953153c9ad7ea81b3dd908c8ca6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in comparative_koala_gray-96 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f39211ebe47510c492b782b320da6dc12ed878ab81ee702328088f564a9812e1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...