EUVD-2025-113837

Malicious code in europa-jasmine-koa-stop npm...

EUVD-2025-115639

Malicious code in cassini-koa-nuxtjs-eslint-plugin npm...

MAL-2025-148086 Malicious code in solis-sequelize-koa-cygnus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a29e3e8c5a3977cec9560fe30b6c2fd0263b5738ea521484c63f631986c17a31 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144195 Malicious code in koa-kaus-sirius-draco (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5da38434c856097646612b2314c16d72307a75149247333f78b7090326adf12 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-140048 Malicious code in blitz-koa-umbra-fork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 737b7cf294e87c05036c5c575e26b364c9f2e68a45faceeedc422a66b098830d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-116046

Malicious code in blitz-pm2-mutation-koa npm...

EUVD-2025-111904

Malicious code in koa-testcafe-koa-zephyr npm...

MAL-2025-147459 Malicious code in rimraf-sync-koa-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 532009f657580cbf19bdbec5522f5677ade66238901cab4f4b3a95a524b4dd7c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-147190 Malicious code in rehype-typeorm-rate-limiter-koa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d96fef6502b7d80768f460d033cc48a5035c10338d164870a174486af09ced8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144196 Malicious code in koa-module-bootstrap-spica (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91a4cb222471bc51975749e78a4951f374ebdaaf33f053ab57fbcd73c4c00e15 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-121013

Malicious code in umbra-chalk-zenith-koa npm...

EUVD-2025-111916

Malicious code in koa-neptune-slidev-tool npm...

EUVD-2025-111918

Malicious code in koa-kaus-sirius-draco npm...

EUVD-2025-111913

Malicious code in koa-polaris-wasat-pegasus npm...

Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak for AIOps version 4.11.1 Vulnerability Details CVEID:CVE-2025-8129 DESCRIPTION: A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0. Affected is the function back in the library lib/response.js o...

SUSE CVE-2025-62595

Koa is expressive middleware for Node.js using ES2017 async functions. In versions 2.16.2 to before 2.16.3 and 3.0.1 to before 3.0.3, a bypass to CVE-2025-8129 was discovered in the Koa.js framework affecting its back redirect functionality. In certain circumstances, an attacker can manipulate th...

CVE-2025-62595

A flaw was found in Koa. A bypass of CVE-2025-8129 was discovered in the Koa.js framework affecting its back redirect functionality. In certain circumstances, an attacker can manipulate the Referer header to force a user’s browser to navigate to an external, potentially malicious website. This...

CVE-2025-62595

Koa is expressive middleware for Node.js using ES2017 async functions. In versions 2.16.2 to before 2.16.3 and 3.0.1 to before 3.0.3, a bypass to CVE-2025-8129 was discovered in the Koa.js framework affecting its back redirect functionality. In certain circumstances, an attacker can manipulate th...

CVE-2025-62595 Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic

Koa is expressive middleware for Node.js using ES2017 async functions. In versions 2.16.2 to before 2.16.3 and 3.0.1 to before 3.0.3, a bypass to CVE-2025-8129 was discovered in the Koa.js framework affecting its back redirect functionality. In certain circumstances, an attacker can manipulate th...

CVE-2025-62595 Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic

Koa is expressive middleware for Node.js using ES2017 async functions. In versions 2.16.2 to before 2.16.3 and 3.0.1 to before 3.0.3, a bypass to CVE-2025-8129 was discovered in the Koa.js framework affecting its back redirect functionality. In certain circumstances, an attacker can manipulate th...