20924 matches found
Cross-site Scripting (XSS)
Overview vega is a library that implements Vega visualization grammar. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the toString function in environments where the VEGADEBUG global variable is present. An attacker can execute arbitrary JavaScript code by...
EUVD-2025-176184
Malicious code in string-beta-benchmark-scale-file npm...
EUVD-2025-177954
Malicious code in markdown-nconf-string-xerxes npm...
EUVD-2025-179137
Malicious code in encrypt-meta-authenticate-log-string npm...
EUVD-2025-178290
Malicious code in java-short-string-java-yaml npm...
EUVD-2025-179846
Malicious code in catch-bash-string-long-catch npm...
EUVD-2025-176185
Malicious code in string-avior-heliophysics-tachyon npm...
EUVD-2025-176180
Malicious code in string-deneb-string-spectroscopy npm...
EUVD-2025-178354
Malicious code in ionosphere-terraforming-string-exosphere npm...
EUVD-2025-177164
Malicious code in pino-remark-string-nestjs npm...
MAL-2025-190185 Malicious code in vortex-auth0-string-holography (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4b12f620e4fb06f261bdd80d409124bb22468e54001e0012b822d68da3e2741 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-179348
Malicious code in delta-string-enum-thread-uglify npm...
MAL-2025-189693 Malicious code in string-container-benchmark-phi-cat (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8eeddb7aaf4eb14b9f84cab9ef4d5c482fe254563dc9dfb921f8ee860c3b659 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-186657 Malicious code in dynamo-sirius-changelog-string (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99724af34264220df5ccb753c1103bd7ff76b4df241a798532e0790d5505f7bf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-176075
Malicious code in tachyon-string-version-sequelize npm...
EUVD-2025-180166
Malicious code in axios-string-kinetic-xenon npm...
Malicious code in izar-string-command-neutronstar (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9dbcaeebf03806cb0ef5c609388515b241112b004e88e71aeee348b374f64a76 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-175695
Malicious code in void-kernel-integer-visualize-string npm...
Malicious code in tachyon-string-version-sequelize (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0fdfc74478a9afbba79d8616c10a0a83eb890f0f6898259eec91b20c796be2c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...