Longitudinal Analyses of SAST Tools: A CodeQL Case Study

Open-source software OSS pipelines rely on automated static analysis tools to prevent the introduction of vulnerabilities in code. However, there is limited understanding of the efficacy of these tools across the OSS ecosystem over time. In this paper, we introduce a novel method to evaluate stat...

CVE-2025-64753

grist-core is a spreadsheet hosting server. Prior to version 1.7.7, a user with only partial read access to a document could still access endpoints listing hashes for versions of that document and receive a full list of changes between versions, even if those changes contained cells, columns, or...

Malicious code in function-assert-orchestrate-theta-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ced639df901c0d1de13cbfbcff06848335dd6fd1617517443157c3e3ee78e72c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in convict-writable-webpack-cosmogenic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d97564ab9fc4db43f4230b9d93ccc412d62ff1b73b25e6ee7eeca8c3f4298df7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hapi-zenobia-ophiuchus-quantum (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f17c724f011c6b531c58109861289727c9168f0ace0072d17a01cb4401e38726 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in resolve-code-sun-sanitize-fast (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abdbdcc8fb619c74fdb9b14089fa86dadcd27a20aad53d18bd359bd1f2d0664b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hexo-boson-charon-framework (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a56cd66ea725cf1761fe3250a133dfda961733f0870f716905609eae11f5f91d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in pi-validate-water-test-tau (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ecddad273b22a7a6a747b0fe0d76b37f55ab197c1c73ad7f8f48726d7bb7c1d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in heka-zenobia-pyxis-mui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09de8556f0fb97ba288cede5fef9a3c8b7626453b5d0b52ec242956372d1b5ee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in adonis-child-process-pegasus-repository (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3209c8b1de00a411a153a4f8dbe6ad93c7dd53375702b75897914da7bd3baf36 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in commitlint-config-angular-nodejs-carpo-vortex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aff6171864c8dd888f734cabf61ae22f26f3868044dd59eb396032310cdbcf72 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kinetic-ora-bootstrap-redshift (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c94144702a359f66450437efd957137a56b3bce619a4b13ed508a050d09d69e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in andromeda-grus-leda-leda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ba83b5896b11f8a71f9cc0fbd13f3202cf4c74871a3ce8a9288b34209bd629a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in juno-saturnology-sass-loader-joviology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector beb54e9749d9d21998cf67910838ec70d40b9d045cee981abefd69fed26a290d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rimraf-isostasy-algol-paleoanthropology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3481301405182aeda1f115cbdd839ab65c80a8048007b504458f4df9b948c27f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cache-publish-decoherence-astroinformatics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f8c45af9f1f787eae1ffc6a38584c3e59ad89115ffe14aaaa705a8994e0708e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in daemon-function-throw-file-dog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5a73e261a4f17a185bcca6a3ab3abc503be436cc2631043966eea2b64c29a97 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in run-script-australis-quito-repository (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42f23afb76dd834950908db36270f132db3d2309a7d62c3f676096e347dfccdb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in arcturus-bellatrix-standard-miranda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7609f325b00b45170897f239a83a8f9f0a9ba0025c5dc5641331b70050b2b2ed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lyra-fomalhaut-arcturus-enceladus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53096e7800c4afe7142f8895c571a8234b3cf07054a65f4b0e757e5cbb5d578e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...