MAL-2025-191247 Malicious code in @mizzle-dev/orm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd528c11fe54881e4913d51e5acc448562c3fc1b7edaae7aa2a40e6b12425f55 The package @mizzle-dev/orm was found to contain malicious code. Source: ghsa-malware c327219099fb121baf202032e61fc1b4881236e892dea9b4aa2b6159f953696...

Malicious code in @huntersofbook/form-naiveui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdec58532c2efc0e228886d82b5dd62cd0699f654168e5c792e524b3a2d73747 The package @huntersofbook/form-naiveui was found to contain malicious code. Source: google-open-source-security...

Malicious code in @voiceflow/dependency-cruiser-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f310f0649a09ab3e8f8ca155d2067e1f39ad9ac40a987851fd0dd352ffc268fe The package @voiceflow/dependency-cruiser-config was found to contain malicious code. Source: ghsa-malware...

Malicious code in @voiceflow/react-chat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7450440b7c3368ef719fcfa9511d7984fc38ed8b5279f4e49f414f588446915e The package @voiceflow/react-chat was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191187 Malicious code in @antstackio/eslint-config-antstack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df3b34f284b315d21cd0f6b7ea57e1fc8b908ade13ffde115d3fb1f6727c7d4a The package @antstackio/eslint-config-antstack was found to contain malicious code. Source: google-open-source-security...

Malicious code in @voiceflow/utils-designer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d83852017d65f3a25b666647c727aaa3aa5db8f3916196a20d92b476e0e8f13 The package @voiceflow/utils-designer was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191289 Malicious code in @posthog/bitbucket-release-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cd4323384e4b29aac2ac56b7eea22bbaafb8579a013ff55f7d7b26f0c972a0a The package @posthog/bitbucket-release-tracker was found to contain malicious code. Source: google-open-source-security...

MAL-2025-191249 Malicious code in @oku-ui/arrow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 085e9cbdb891d5b550a81a42584b1cdd8ab001a9443b162158aa633ce18b1e06 The package @oku-ui/arrow was found to contain malicious code. Source: google-open-source-security...

MAL-2025-191125 Malicious code in lui-vue-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1ec012cfb1edfb9761b430b0782b52888c004d3b836117ecf2e28bd16e62d5b The package lui-vue-test was found to contain malicious code. Source: ghsa-malware 390e4d5770dff6841abe0c2eb89f94237238ea21ec3811361c614593c28ee002 A...

MAL-2025-190921 Malicious code in capacitor-voice-recorder-wav (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15d039d86e89d2e74c80f640d3c4dc358a5e3fc0b972d07a1d08b9c5dee3dad9 The package capacitor-voice-recorder-wav was found to contain malicious code. Source: ghsa-malware...

EUVD-2024-55097

Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GET parameter not being sanitized...

CVE-2024-8528

CVE-2024-8528 concerns reflected XSS in Automated Logic WebCTRL and Carrier i-Vu. The Red Hat/CISA-enriched and CVE records converge on a vulnerability where a specific GET parameter (not sanitized) allows an attacker to deliver a malicious payload via a crafted URL, targeting a user’s browser. A...

CVE-2025-9501

The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the parsedynamicmfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post...

CVE-2025-9501

CVE-2025-9501 - W3 Total Cache (WordPress) : The vulnerability affects the WordPress W3 Total Cache plugin up to version 2.8.13. The root cause is a command injection in the _parse_dynamic_mfunc function that allows unauthenticated users to submit a malicious payload in a post comment to execute ...

Malicious code in bad-xml-simple-yaml-reject (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1084f45e2b231ed30cdbb03493b4346773bba921e81e7b020cd83f67573b669 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nodemon-meissa-outercore-hyperion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba2e23c45539583f659e07b8c25c6f64355c7809af168ed58fe5b4b1e9e94297 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in quantum-exosphere-vortex-adonis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38a8dfbfb03df9e686bbfc44f4f424a75d1ca4f283e5c4dd99b97ae0e381a73b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in airbnb-mensa-geochemistry-husky (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 461789ded976ec21d5ed453dba1ce5adf24b99d90b2a96b833566afddbb99068 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in airbnb-australis-inflation-changelog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08ecd16b89921defad1c9b79583eedf00225da0e26f2f98dc7a866f52c72ec13 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nashira-dotenv-parse-variables-gulp-lynx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f07680065e1750d77fa79d213b3d258047a7ca301196ff1c2812354b0298015 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...