Malicious code in andi-keripik65-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 641d591dcc8916554086c3744775cc5b906279731b6cdbc544fe073ff0e92d66 The package andi-keripik65-sukiwir was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that...

Malicious code in dono-lepet19-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29362e690edadf049901556fd81d29b06ce41042dc64c2d250b2bfdb5dedb4ea The package dono-lepet19-ruro was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...

@advclb/sassdoc-loader (0.1.0), @alifd/sassdoc-parser (>=0.1.0, <=2.0.1) +148 more potentially affected by CVE-2025-57326 via sassdoc-extras (>=1.0.3, <=3.0.0)

sassdoc-extras NPM version =1.0.3, =0.1.0, =0.0.3, =0.0.3, =0.0.8, =3.0.0, =3.2.0, =2.3.0-rc.0, =0.0.1, =0.1.2, =10.1.0, =10.18.0-rc.0, =0.1.18, =99.0.372 and more Source cves: CVE-2025-57326 Source advisory: SNYK:JS-SASSDOCEXTRAS-13110008...

@58860ed6ffd9e897/gold-finger-extension (1.0.2), @ableaura/ableui (0.1.0) +1498 more potentially affected by CVE-2025-56648 via @parcel/reporter-dev-server (>=2.0.0-beta.1, <=2.16.4)

@parcel/reporter-dev-server NPM version =2.0.0-beta.1, =5.1.9, =7.0.0, =8.3.0-pre.2022-06-22.sha-42703caf, =7.0.0, =0.1.0, =1.0.0-beta.2, =5.0.0, =0.0.9, =0.0.1, =5.1.0, =5.2.5 and more Source cves: CVE-2025-56648 Source advisory: SNYK:JS-PARCELREPORTERDEVSERVER-12878606...

@contentql/core (>=0.1.2, <=0.3.5), @launchthat.apps/payload-shadcn (>=0.1.0, <=0.1.8) +9 more potentially affected by CVE-2025-4643 via @payloadcms/next (>=3.0.0-beta.48, <=3.43.0-internal.693bd81)

@payloadcms/next NPM version =3.0.0-beta.48, =0.1.2, =0.1.0, =3.2.0, =0.2.0, =0.1.0, =0.1.4, =1.0.0, =0.0.9-alpha.5, =3.0.0-beta.3, =0.0.3, =0.2.0, =0.2.42 Source cves: CVE-2025-4643 Source advisory: OSV:GHSA-5V66-M237-HWF7...

02.koa-demo (1.0.0), 0510test (1.0.0) +13450 more potentially affected by unknown CVE via koa (>=0.0.1, <=3.2.1)

koa NPM version =0.0.1, =1.3.7, =1.0.0, =0.0.1, =1.0.0, =1.0.1 - 2-26 1.0.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-KOA-12143256...

2d-json-schema-editor-visual (>=1.0.2, <=1.0.7), 37sy-build (>=1.0.0, <=1.3.3) +4368 more potentially affected by CVE-2025-9288 via sha.js (>=2.1.1, <=2.4.11)

sha.js NPM version =2.1.1, =1.0.2, =1.0.0, =1.0.0, =1.0.0, =0.1.6, =1.0.0, =0.0.4, =0.1.0, =7.13.4, =18.0.0, =18.1.2 - @ajhyndman/relay 1.6.0-1 - @aldendaniels/react-scripts 0.8.3 and more Source cves: CVE-2025-9288 Source advisory: SNYK:JS-SHAJS-12089400...

Malicious code in zsyirwqjgxeopbhc (npm)

The package zsyirwqjgxeopbhc was found to contain malicious code...

Malicious code in orange-8zg-project (npm)

The package orange-8zg-project was found to contain malicious code...

com.prototyper.openai-editor-tool (0.1.3) potentially affected by unknown CVE via com.unity.nuget.newtonsoft-json (0.0.1-security)

com.unity.nuget.newtonsoft-json NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on com.unity.nuget.newtonsoft-json and may be impacted: - com.prototyper.openai-editor-tool 0.1.3 Source cves: unknown CVE Source advisory:...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @antonyfaris/prefix-node-builtins (>=1.0.0, <=1.0.1) +19 more potentially affected by CVE-2025-54793 via astro (>=5.2.1, <=5.12.6)

astro NPM version =5.2.1, =0.0.1, =1.0.0, =1.0.0, =1.25.426-4, =0.6.2, =0.0.0-dev-20250414184926, =0.0.1, =0.0.1, =2.1.22, =1.0.3, =0.1.0, =0.3.19, =0.3.20 - astro-theme-stalux 1.0.0 and more Source cves: CVE-2025-54793 Source advisory: OSV:GHSA-CQ8C-XV66-36GW...

10by10-react-app (1.2.1), 192.168.0.172 (4.6.1) +13883 more potentially affected by CVE-2025-7339 via on-headers (>=1.0.0, <=1.0.2)

on-headers NPM version =1.0.0, =1.0.2, =1.0.0, =0.30.0, =0.2.0, =0.0.28, =4.11.0, =4.11.46 and more Source cves: CVE-2025-7339 Source advisory: OSV:GHSA-76C9-3JPH-RJ3Q...

eth-utils (>=0.1.1, <=0.2.0), evm (>=0.17.3, <=0.36.0) +25 more potentially affected by CVE-2025-53359 via ethereum (>=0.4.2, <=0.12.0)

ethereum CARGO version =0.4.2, =0.1.1, =0.17.3, =1.0.0, =1.0.0, =1.0.0, =1.0.1 - ovr-evm-precompile-ed25519 2.0.0 - ovr-evm-precompile-modexp 2.0.0 - ovr-evm-precompile-sha3fips 2.0.0 - ovr-evm-test-vector-support 1.0.0 and more Source cves: CVE-2025-53359 Source advisory: OSV:GHSA-3W94-VQ2X-V5WR...

@adebaraayomide/synchro_sdk (>=0.0.3, <=0.1.0-synchro-sdk), @aloe2/abstract-eth (1.0.20228282226) +271 more potentially affected by CVE-2025-47934 via openpgp (>=5.0.1, <=5.11.2)

openpgp NPM version =5.0.1, =0.0.3, =0.1.0-synchro-sdk - @aloe2/abstract-eth 1.0.20228282226 - @aloe2/abstract-utxo 1.1.20228282226 - @aloe2/account-lib 2.20.20228282226 - @aloe2/bitgo 14.2.20228282226 - @aloe2/sdk-api 1.1.20228282226 - @aloe2/sdk-coin-ada 1.1.20228282226 - @aloe2/sdk-coin-algo...

21cmpsdenoiser (>=1.0.0, <=1.0.2), 2404-segmentation-pipeline (>=0.1.0, <=1.0.0) +27704 more potentially affected by CVE-2025-3121 via torch (>=1.0.0, <=2.13.0)

torch PYPI version =1.0.0, =1.0.0, =0.1.0, =1.0.0, =0.1.0, =2.13.0, =0.1.0, =0.1.0, =0.1.3, =0.1.0, =0.1.0, =0.0.1, =0.0.1, =0.0.16 and more Source cves: CVE-2025-3121 Source advisory: SNYK:PYTHON-TORCH-10337834...

123-x-ed-eied (>=1.0.5, <=1.0.6), @0xdeepak/wallets (0.0.2) +617 more potentially affected by CVE-2025-29927 via next (>=12.0.0, <=12.3.4)

next NPM version =12.0.0, =1.0.5, =1.0.0, =1.1.1, =0.0.2-beta.0, =0.0.2-beta.0, =0.0.7, =0.0.0, =1.2.4, =3.6.2, =3.6.13 and more Source cves: CVE-2025-29927 Source advisory: OSV:GHSA-F82V-JWR5-MFFW...

ai-dynamo (>=0.1.0, <=0.3.0), bento-sgl-router (>=0.0.1, <=0.0.6) +31 more potentially affected by CVE-2024-9056 via bentoml (>=0.9.2, <=1.4.39)

bentoml PYPI version =0.9.2, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.2.3, =0.0.1, =0.0.10, =0.1.0, =0.2.0, =0.0.1, =0.3.12.dev20240709150559, =0.3.52 and more Source cves: CVE-2024-9056 Source advisory: SNYK:PYTHON-BENTOML-9508724...

adclaw (>=1.0.0, <=1.0.33), agentjet (0.0.1) +45 more potentially affected by CVE-2024-8438 via agentscope (>=0.1.0, <=2.0.6)

agentscope PYPI version =0.1.0, =1.0.0, =0.3.0, =0.1.0, =0.2.0, =0.1.5, =1.0.0.post2, =0.1.0b1, =0.1.0, =0.0.1, =0.1.0, =0.2.0 and more Source cves: CVE-2024-8438 Source advisory: SNYK:PYTHON-AGENTSCOPE-9511412...

adclaw (>=1.0.0, <=1.0.33), agentjet (0.0.1) +45 more potentially affected by CVE-2024-8489 via agentscope (>=0.1.0, <=2.0.6)

agentscope PYPI version =0.1.0, =1.0.0, =0.3.0, =0.1.0, =0.2.0, =0.1.5, =1.0.0.post2, =0.1.0b1, =0.1.0, =0.0.1, =0.1.0, =0.2.0 and more Source cves: CVE-2024-8489 Source advisory: SNYK:PYTHON-AGENTSCOPE-9599695...

@accelint/vitest-config (0.1.4), @ai16z/plugin-evm (>=0.1.5-alpha.2, <=0.1.5-alpha.5) +93 more potentially affected by CVE-2025-24964 via vitest (>=2.0.0-beta.13, <=2.1.8)

vitest NPM version =2.0.0-beta.13, =0.1.5-alpha.2, =0.1.5-alpha.0, =0.1.5-alpha.0, =0.1.5-alpha.0, =0.0.0, =0.0.1, =0.1.1, =1.2.1-preview-1bd7791.0, =0.0.1, =0.1.8-alpha.1, =0.1.9 and more Source cves: CVE-2025-24964 Source advisory: OSV:GHSA-9CRC-Q9X8-HGQQ...