EUVD-2025-124575

Malicious code in nebula-janus-parcel-pino npm...

EUVD-2025-123947

Malicious code in parcel-winston-janus-janus npm...

Malicious code in stream-loop-parcel-npm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38929f7a646ff8d1293e4c17a38a88606996a4ab7d34e053fdd1cfb786e8e510 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-111381

Malicious code in materialize-await-equinox-parcel npm...

EUVD-2025-113980

Malicious code in equinox-parcel-blaze-docusaurus npm...

EUVD-2025-123229

Malicious code in protractor-parcel-wasat-chariklo npm...

EUVD-2025-123969

Malicious code in parcel-bunyan-weywot-nightwatch npm...

Malicious code in parcel-mui-event-callback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf3a8fdcd7a231752e40c7d558b2efeafc603d9ec4bee1ff23f8c5ec2d88e5df This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-123967

Malicious code in parcel-chariklo-uninstall-regulus npm...

MAL-2025-143814 Malicious code in janus-jekyll-parcel-dotenv-safe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e089175016e2fd98fcc7c70267365ac25096a7d0e92459ca5ba25280086f96c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141263 Malicious code in cross-env-parcel-forever-perseus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbff56665ae37d90628d5c06182c5e45b39d4b4921a2f7476a3c3cabef7a62f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145477 Malicious code in nightwatch-parcel-cypress-quantum (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4543b97d0328d50b59b438e8deb148f568db56de4b1fb5dedb47f443bf2033a1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145971 Malicious code in parcel-sedna-react-bootstrap-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae09af36af178a81acf4d4e93bc643df245329f487f8538f7c695e995af2c730 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-121655

Malicious code in start-fornax-cosmos-parcel npm...

MAL-2025-147782 Malicious code in sedna-parcel-schema-envconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b76b84d5791a3dbd892a09ff247e6fc2d37a23c1113018b013617082887cde9a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142727 Malicious code in fusion-callisto-parcel-nestjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78094ec84b44c653fb466d59da99ced3eb3102b8ca8e13b0bef3f006f795826d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145954 Malicious code in parcel-chariklo-uninstall-regulus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac7a1b13b8d6e0e8c05215c12ec51bb034a48d28a92164cfa19cddfc7a326a89 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145946 Malicious code in parcel-algol-websockets-delphinus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c57bfb271ed0be2a37c4903201cee169c43cb8a36467c7594c743bb1addd9942 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in parcel-rollup-plugin-andromeda-betelgeuse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0aadf58e83bbd93bf6fdc89a44ce9ae8e2b41ca169e02a04313e35a1f02b2c7b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Origin Validation Error

@parcel/reporter-dev-server is vulnerable to an Origin Validation Error. The vulnerability is due to the server failing to verify and enforce the Origin header for XMLHttpRequests. An attacker can host a malicious webpage that issues cross-origin XMLHttpRequests to a developer's running dev serve...