@axiom-lattice/agent-eval (>=2.1.9, <=2.1.100), @axiom-lattice/core (>=2.1.0, <=3.0.7) +15 more potentially affected by CVE-2025-68665 via langchain (>=1.0.2, <=1.2.0)

langchain NPM version =1.0.2, =2.1.9, =2.1.0, =1.0.11, =2.1.0, =0.1.1, =1.0.1, =1.0.1, =1.0.0, =0.1.3, =3.66.0, =3.66.0, =5.7.2, =0.0.1, =0.3.0, =0.3.1 - hedera-agent-kit 3.5.2 and more Source cves: CVE-2025-68665 Source advisory: OSV:GHSA-R399-636X-V7F6...

@abovethefray/klaviyo-adobe-commerce-app-checkout-consent-dropin (>=0.0.1, <=1.0.0), @adobe-commerce/elsie (>=1.0.0-alpha04071347, <=2.0.0-alpha-20260514091936) +51 more potentially affected by CVE-2025-68429 via @storybook/builder-webpack5 (>=8.0.0, <=8.6.14)

@storybook/builder-webpack5 NPM version =8.0.0, =0.0.1, =1.0.0-alpha04071347, =0.2.9, =1.0.6, =0.0.0-AddSnapshotPipeline-20240326102812, =0.11.1-aa792aa-20250325153437, =0.12.1-aa792aa-20250325153437, =0.0.1-10adad4-20260325085110, =1.0.12, =3.32.0-rc.2, =9.0.0-next.47, =9.0.0-next.67 and more...

@cedarjs/api-server (>=1.0.0-canary.12879, <=1.0.0-canary.12881), @cedarjs/cli (>=1.0.0-canary.12879, <=1.0.0-canary.12881) +10 more potentially affected by CVE-2025-55183 +2 more via react-server-dom-webpack (19.2.2)

react-server-dom-webpack NPM version 19.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on react-server-dom-webpack and may be impacted: - @cedarjs/api-server =1.0.0-canary.12879, =1.0.0-canary.12879, =1.0.0-canary.12879, =1.0.0-canary.12879,...

@cedarjs/api-server (>=1.0.0-canary.12863, <=1.0.0-canary.12878), @cedarjs/cli (>=1.0.0-canary.12863, <=2.0.3-next.1) +13 more potentially affected by CVE-2025-55183 via react-server-dom-webpack (>=19.2.0-canary-cee7939b-20250625, <=19.2.1)

react-server-dom-webpack NPM version =19.2.0-canary-cee7939b-20250625, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863, =1.0.0-canary.12863,...

00ld8nuivn (2.1.0), 00rqiw31nd (2.1.0) +3710 more potentially affected by CVE-2025-65945 via jws (>=3.0.0, <=3.2.2)

jws NPM version =3.0.0, =3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on jws and may be impacted: - 00ld8nuivn 2.1.0 - 00rqiw31nd 2.1.0 - 01dk01majk 2.1.0 - 02rjq8i863 1.1.0 - 02vx8qsp01 2.1.0 - 05y6tjgmws 1.1.0 - 066m7q8o0z 2.1.0 - 06buj9h3su...

Malicious code in karem4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a1d3bd676881934532a2e75fd644e22b2e4f26fb08bde6d48ff6d529de7467d The package karem4 was found to contain malicious code. Source: ossf-package-analysis b843a0d849da7453ce803b77a117a501a3b1e4b04eae8222d3b59d48438931c...

Malicious code in airbnb-mensa-geochemistry-husky (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 461789ded976ec21d5ed453dba1ce5adf24b99d90b2a96b833566afddbb99068 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189675 Malicious code in stratigraphy-castor-subduction-thermochronology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f95e074cf44d088a943a7366dcf7a4c1bcf3bd044d9b79a6733eab0a5ec6e5b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-182642 Malicious code in imugiay-avg-daiugadajdufij (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d99d4e1d71eddebea66b98c5c96698b940e990c10c38e7e8fcb96e154eb72ee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

@akunsansan0/geulis94 (1.1.4), bata1 (1.0.0) +41 more potentially affected by unknown CVE via geulis94 (>=2.2.2, <=3.1.1)

geulis94 NPM version =2.2.2, =3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on geulis94 and may be impacted: - @akunsansan0/geulis94 1.1.4 - bata1 1.0.0 - bata10 1.0.0 - bata11 1.0.0 - bata2 1.0.0 - bata3 1.0.0 - bata4 1.0.0 - bata5 1.0.0 - bata6...

MAL-2025-180930 Malicious code in teate-thy-sonic-selwe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73ab9c0ad863c7f1263892cb683c7ba2d77239db174d1efe35251c704f9ee259 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-134734

Malicious code in anais-papmoa-yama0paiog npm...

EUVD-2025-141161

Malicious code in kapo-sadamuda-mimanua npm...

MAL-2025-172726 Malicious code in affri-zidan-tea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66131e784783421656cc31ce8d41a75b1793f763b27b4402d9a0805a9512d0b3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in akanabi-aibia-bau (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd4087f82cfe1f0042e05e33c3f3d231764c7ef3ac274603bf0abdd30b8682b8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-156891 Malicious code in irashi-2aa-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fea4306e8c518625590928f49ee35475a775bde8850db9021a7ccf7f216113e9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-160890 Malicious code in munir-butya-tssyu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88d4f0a9ef3b70f69fd1fc3598e2702964262bcaf3af3d51969470aedac01e9d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-165325 Malicious code in sabua-muhasi-nafaya (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85245fffe58a8419e7d1c42902b316b129ea2901a3e0c15c7e0ce9de1221f15d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tadashi-tssu-renew (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6818a8a99356bd1c1cf31a80787547b40ec89346fb2f08ccc41c38eb28f61294 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155592 Malicious code in hafiz-36 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c322091041c59de02afc3628ca58be55afcfa4aa5935c82b551154f2922b836 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...