MAL-2025-70261 Malicious code in regular-blush-heron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 701cf95dd3d10fa91840b0643c097fe4584a6c16f9f60c1c8aa4d26bf646ee97 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-55351

Malicious code in coloured-jade-heron npm...

Malicious code in involved-peach-heron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 771761e6cee13d31f0f84b36fb192b4eab23a74c6d27f1e764ee257debcbc20f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-55997

Malicious code in adjacent-aqua-heron npm...

EUVD-2025-55444

Malicious code in civilian-amaranth-heron npm...

EUVD-2025-52389

Malicious code in regular-aqua-heron npm...

EUVD-2025-52258

Malicious code in rigid-lavender-heron npm...

EUVD-2025-55192

Malicious code in continuing-silver-heron npm...

EUVD-2025-55628

Malicious code in bold-brown-heron npm...

MAL-2025-69442 Malicious code in mixed-crimson-heron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16d0b9b18d72abeba489dd2f435608f82984eb8f0efda0fcbf3e8732a3afab6a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2018-3788

Malware in sbrugna...

EUVD-2022-7061

Malicious code in bioql PyPI...

EUVD-2022-0617

Malicious code in bioql PyPI...

MAL-2025-34891 Malicious code in test-mlw2-arled-blots-heron-nooky (npm)

The package test-mlw2-arled-blots-heron-nooky was found to contain malicious code...

Malicious code in @malware-test-bovid-tondi-knead-heron/test-mlw3-bovid-tondi-knead-heron (npm)

The package @malware-test-bovid-tondi-knead-heron/test-mlw3-bovid-tondi-knead-heron was found to contain malicious code...

Malicious code in test-mlw2-heron-sleet (npm)

The package test-mlw2-heron-sleet was found to contain malicious code...

MAL-2025-35513 Malicious code in test-mlw2-heron-sleet (npm)

The package test-mlw2-heron-sleet was found to contain malicious code...

CVE-2021-42010

Heron versions = 0.20.4-incubating allows CRLF log injection because of the lack of escaping in the log statements. Please update to version 0.20.5-incubating which addresses this issue...

CVE-2020-1964

It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerabilities CWE-502: Deserialization of Untrusted Data...

CVE-2018-11789

When accessing the heron-ui webpage, people can modify the file paths outside of the current container to access any file on the host. Example woule be modifying the parameter path= to go to the directory you would like to view. i.e. ..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd...