EUVD-2025-121712

Malicious code in spinner-uglify-js-sequelize-sync npm...

EUVD-2025-123819

Malicious code in perseus-ora-spawn-uglify-js npm...

EUVD-2025-121063

Malicious code in uglify-js-apollo-cosmos-karma npm...

EUVD-2025-112244

Malicious code in jasmine-uglify-js-cygnus-markdown npm...

EUVD-2025-124766

Malicious code in mongoose-firebase-local-uglify-js npm...

EUVD-2025-112863

Malicious code in helmet-dactyl-flare-uglify-js npm...

EUVD-2025-111957

Malicious code in kaus-uglify-js-version-node-config npm...

MAL-2025-147033 Malicious code in rate-limiter-carina-despina-uglify-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5d89afb49e1baf7114e84e9d0a8e776e8bd8a7494a4fcaa12145552f4ec4505 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-121050

Malicious code in uglify-js-quantum-vuepress-publish npm...

EUVD-2025-120185

Malicious code in xo-despina-uglify-js-neptune npm...

EUVD-2025-123994

Malicious code in package-dactyl-callisto-nuxtjs npm...

PT-2025-46851

Name of the Vulnerable Software and Affected Versions js-yaml versions prior to 4.1.1 Description js-yaml is a JavaScript YAML parser and dumper. A flaw exists where an attacker can alter the prototype of a parsed YAML document, leading to prototype pollution. This impacts users parsing untrusted...

EUVD-2025-75204

Malicious code in worriedcod-gooddev npm...

EUVD-2025-62316

Malicious code in regionalfireflyz3n npm...

CVE-2025-13018

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird 140.5...

EUVD-2025-44032

Malicious code in reactjs-fabric npm...

CVE-2025-64167: Improper Neutralization of Input During Web Page Generation

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to a cross-site scripting attack leading to JS execution when editing the URL parameter. Versions 2.7.13 and 3.2.2 don't use export.php, which was deprecated. They use export-v2.php instead...

PT-2025-47235

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=458199402 Crash type: Heap-use-after-free READ 8 Crash state: JS DefineProperty build backtrace JS CallInternal...

PT-2025-47066

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=457858149 Crash type: Use-of-uninitialized-value Crash state: JS DefineProperty build backtrace JS CallInternal...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the jsarraybufferslice function. An attacker can access sensitive information or cause application instability by triggering a buffer over-read through crafted input. Remediation A fix was pushed into the...