Cross-site Scripting (XSS)

Overview org.webjars.npm:vega-expression is a WebJar for vega-expression. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the toString function in environments where the VEGADEBUG global variable is present. An attacker can execute arbitrary JavaScript code by...

CVE-2025-59840

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 6.2.0, applications meeting 2 conditions are at risk of arbitrary JavaScript code execution, even if "safe mode" expressionInterpreter is used. They...

EUVD-2025-113765

Malicious code in exec-jabbah-dotenv-parse-variables-neptune npm...

EUVD-2025-114392

Malicious code in dotenv-parse-variables-despina-helios-venus npm...

EulerOS 2.0 SP10 : libssh (EulerOS-SA-2025-2420)

According to the versions of the libssh package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large input buffer to sshgetfingerprinthash...

EulerOS 2.0 SP12 : libssh (EulerOS-SA-2025-2332)

According to the versions of the libssh package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the sshkdf function responsible for key derivation...

EUVD-2025-101054

Malicious code in variablehamsterz3n npm...

kernel: tracing/histograms: Fix memory leak problem

In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Fix memory leak problem This reverts commit 46bbe5c671e06f070428b9be142cc4ee5cedebac. As commit 46bbe5c671e0 "tracing: fix double free" said, the "double free" problem reported by clang static analyzer is: In...

Malicious code in variable_elk-notthedevs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f698ee5c5cc56eddedc13a95d5a90bd8cdfe1812ca0c4d8bd0da7d3413c632f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-75297

Malicious code in variablemeerkat-appteadev npm...

EUVD-2025-77990

Malicious code in variablellamaz3n npm...

EUVD-2025-80140

Malicious code in variablestingrayreplicateautomation npm...

EUVD-2025-80142

Malicious code in variableharrier0xrequest npm...

Malicious code in variable_harrier_0xrequest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41c37f01830d5a5fb385de9393cb00a756b25c8d5af979a89e6c2ea31248b45e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-80143

Malicious code in variablealligator0xrequest npm...

EUVD-2025-65594

Malicious code in variableporpoisez3n npm...

MAL-2025-86096 Malicious code in great_felidae_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 975251481db80a9c72c860e7202fed5576f556e2ad750dc551fd74285a7812e0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in variable_porpoise_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf10dd9c18bcb2d6983fa05b87b77092ba6aa0d3921e11046323cec922c039b2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-82019 Malicious code in variable_spoonbill_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 765df721f21736f8e96171505f172d6ad289ae1b51fef12191c963dd334187e2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in variable-chocolate-cat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd7b0fd9e3f50e752b35cfce7a47ce377dc128160dffb348b2c38d46abee17c2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...