UBUNTU-CVE-2025-64718

js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution proto. All users who parse untrusted yaml documents may be impacted. The problem is patched in...

CVE-2025-64718 js-yaml has prototype pollution in merge (<<)

js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution proto. All users who parse untrusted yaml documents may be impacted. The problem is patched in...

CVE-2025-64718

CVE-2025-64718 affects js-yaml, allowing prototype pollution via proto when parsing untrusted YAML. The issue is patched in js-yaml 4.1.1 and in 3.14.2. Public IBM bulletins confirm usage of vulnerable js-yaml versions in IBM Maximo components and recommend upgrading to a fixed release (e.g., js-...

CVE-2025-64718 js-yaml has prototype pollution in merge (<<)

js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution proto. All users who parse untrusted yaml documents may be impacted. The problem is patched in...

CVE-2025-64718

js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution proto. All users who parse untrusted yaml documents may be impacted. The problem is patched in...

EUVD-2025-178243

Malicious code in juno-uglify-js-tethys-thermochronology npm...

EUVD-2025-175803

Malicious code in unuk-uglify-js-astrochemistry-comet npm...

EUVD-2025-179790

Malicious code in chakra-ui-standard-nuxtjs-sass-loader npm...

EUVD-2025-175656

Malicious code in warp-dotenv-safe-andromeda-uglify-js npm...

EUVD-2025-176953

Malicious code in proxima-uglify-js-biomimicry-quasar npm...

Malicious code in uglify-js-gatsby-mocha-titan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35678a78049826e95243c5ef05b567ec7a727ae22384d50851840ccd22a90cf5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-176088

Malicious code in sync-uglify-js-rest-superagent npm...

EUVD-2025-176357

Malicious code in sirius-nuxtjs-genomics-hydrogeology npm...

EUVD-2025-180060

Malicious code in bioinformatics-proxima-uglify-js-rimraf npm...

EUVD-2025-180051

Malicious code in biosignature-nestjs-publish-morgan npm...

EUVD-2025-178061

Malicious code in lithosphere-changelog-grunt-uglify-js npm...

EUVD-2025-179630

Malicious code in commitlint-config-angular-nodejs-carpo-vortex npm...

EUVD-2025-178083

Malicious code in link-uglify-js-fermiparadox-auth npm...

EUVD-2025-177200

Malicious code in phoenix-apollo-nextjs-nova npm...

Malicious code in unuk-uglify-js-astrochemistry-comet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f57906ac6a4735bb92280c00660dfe0fcb082121021fc0d695fd942e50c6163c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...