Malicious code in javascript-stop-solis-magellan (npm)

Source: amazon-inspector 604e6dfd483497d82c03b53aa28709fb0bd1b3c4692e4a3b5af4259d9b7041b1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in javascript-appfabric-logger (npm)

Source: ossf-package-analysis 9f8b7cd0cdd29ede135536b1e9ca802d8bfd2343e149fb7fd4ff7de38a4d1813 The OpenSSF Package Analysis project identified 'javascript-appfabric-logger' @ 966.0.0 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with...

Malicious code in javascript-spinner-rocket-nightwatch (npm)

The package javascript-spinner-rocket-nightwatch was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in javascript-chai-levels-meissa (npm)

Source: amazon-inspector f3f54d571407559b74364357ae31392c1675aeba12ac051cd7497dc96918574e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in javascript-readable-fetch-nconf (npm)

Source: amazon-inspector 3827cbbd47b302e1ef59e4c94ec650165f357e5bbd37b488b09940b80b763a5f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in javascript-css-minimizer-webpack-plugin-geochronology-foundation (npm)

Source: amazon-inspector 541d9f2ae859b256fb3d8578c48df0d858a1f1fca17072d9018dfbb8b3c0c6eb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in javascript-scorpius-global-framework (npm)

Source: amazon-inspector 6a295c603b76a38d618d9f50be6f6317eb946aa55b04eefa49bfe10b3e03fc9e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in io-gulp-apollo-javascript (npm)

Source: amazon-inspector da8d41017f6e1f3ead37a2a51382ab373e4ef1361ea5981924ff463f050d0659 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ini-wasat-react-bootstrap-javascript (npm)

Source: amazon-inspector 37bcd35eba4a00c390477b1fbe300caa6a78526cf8dd7a566a6fbbf3720279f7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

CVE-2025-64059

Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content...

CVE-2026-90776

Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email addresses with RFC 5322 comments. Attackers can craft malicious email headers with comment-separated atoms to consume excessive CPU and block the Node.js...

CVE-2026-90772

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or...

Flowise-RCE-CVE-2025-59528

CVE-2025-59528 — Flowise AI Authenticated Remote Code Execution RCE Overview CVE ID: CVE-2025-59528 Affected Software: Flowise AI Vulnerable Versions: = 3.0.4 Fixed Version: 3.0.5 and later Severity: Critical Author: r3nsi15 Date: 2025 Description Flowise AI versions up to and including 3.0.4 all...

EUVD-2026-76993

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or...

CVE-2026-90772 Amundsen Frontend through 4.3.0 Stored XSS via Description

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or...

CVE-2026-90772 Amundsen Frontend through 4.3.0 Stored XSS via Description

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or...

Malicious code in heka-bootstrap-javascript-loopback (npm)

Source: amazon-inspector 79bcabd4095430daa841c61c56b16ee60347e93be2e7f9c25d47d2a34c398593 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in gulp-javascript-carpo-markdown-pdf (npm)

Source: amazon-inspector 83f3fb31d46de531e486584cf860923fbaef0e8a21f7f9233132af1ea5a5ebc4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in grus-css-loader-javascript-elektra (npm)

The package grus-css-loader-javascript-elektra was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in graphql-javascript-sedna-weywot (npm)

Source: amazon-inspector 46d45f9ef942a20757d0345a40f2fbf72f9bd810af26d2d8157287aa2a5a943e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...