GHSA-2C9Q-C2Q9-QGQV langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication

Summary In affected versions of langgraph-api the LangGraph Server runtime, a run or cron could be created with a relative webhook target. When the server later delivers such a webhook, it routes the request back into the same application through an in-process loopback transport that the...

EUVD-2025-177040

Malicious code in process-loopback-cosmos-leda npm...

Malicious code in sagitta-xml-child-process-loopback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a994e3d9f806b277e2a6fe89497b8bd8b217966da20b43ec15ace8cfad2690ae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-122291

Malicious code in sagitta-xml-child-process-loopback npm...

MAL-2025-44661 Malicious code in hyperion-despina-process-loopback (npm)

The package hyperion-despina-process-loopback was found to contain malicious code...

Malicious code in hyperion-despina-process-loopback (npm)

The package hyperion-despina-process-loopback was found to contain malicious code...