Longitudinal Analyses of SAST Tools: A CodeQL Case Study

Open-source software OSS pipelines rely on automated static analysis tools to prevent the introduction of vulnerabilities in code. However, there is limited understanding of the efficacy of these tools across the OSS ecosystem over time. In this paper, we introduce a novel method to evaluate stat...

CVE-2025-64753

grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document could still access endpoints listing hashes for versions of that document and receive a full list of changes between versions, even if those changes contained cells, columns, or...

Malicious code in achernar-hermes-centauri-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eab22301bbc8cc3305c04124149153e96718f5a79c8fcdcd1f4e7e2d96ec6c23 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in meissa-pavo-asthenosphere-aurora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c245ebc6d662cd2d791c2a665a08b64c0ac325a3faea4ed570146f511d921147 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in good-minify-private-container-object (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b032c4996d44ce62c30eba2b2781375d7b3c99daea21c2cbf85535105cb6269 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in restart-jabbah-module-quantum-computing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 754f89bb05d71cb06dabc0ad38d390187aa8c02187779be6e45282fc31257f37 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188055 Malicious code in minify-report-compress-compress-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99dbbec0f45be78a69c0e58da0c15b858336cd03082f3e4bae5bd685bf93c25e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in helios-jekyll-polaris-soap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 185b2314d9675d6e627b2ef3b7251acbba2ffb5ecf02743553126f3e6cd7e1b2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187093 Malicious code in gamma-old-visualize-web-view (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c85b8c83f11198dd37909d77ea949f07b7f4f84ed769cfb14f898b385924bd0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in transhumanism-blueshift-thuban-geckodriver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42d67c23d5b5afa24d365f038dfc900460ad6920968cb7725c1ff6a31a5a2172 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187496 Malicious code in install-enif-blitz-supervisor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36141e3666f8c066649d564f1f74956d7c95b2120dc6f9c0abec69c4a3bfb1b9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in decoherence-neptune-saturnology-transport (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b550a9f0da242bfe9f0ba64dec95e44265c55f7236a1934c5bc5b965ee23c4c6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-190471 Malicious code in zephyr-sadr-child-process-bootes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 146ecbbd3d8f2cb52b7a37a21f83f89b55640c24e6ac37ad73bd82f76b37752c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in air-epsilon-zeta-key-bundle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3315bade14bc91e0c028f375cddafcc7a08630f221281feff53d52abe8355d54 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lint-loop-playwright-publish (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a242525b6943fcf77698c5a6cc5a7f8ac4ce45fb053ebad712afff73b5e0a81 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-186423 Malicious code in css-minimizer-webpack-plugin-phoebe-biogeochemistry-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7e88aea6bc6d5bdfac3ccf178293c7fd3391a33d7bd847a88e2bed3c2f2efc7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in docusaurus-buffer-sequelize-cassini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b662cd60cd555d9bacb27298d83489c90bb2da7c8889ef66f142b25ac4c91cc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-190186 Malicious code in vortex-enceladus-slides-xanthus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 459c37c88702ede938d6aefee367e7cab529ff9cff4c09b2c9bd4ea0e63730fc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185731 Malicious code in bad-eta-encrypt-error-signal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1430a541231c581ecaecf6111ee0646d539ec2f560fe6401ba786567cbe1eef2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xenon-release-it-telesto-jabbah (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 156c3f239097b5a3342ea65e94f1f7759096530b2c5377c81f15266c47ac3366 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...