npm - OSV

MAL-2026-6025

npm/@mastra/koa

Malicious code in @mastra/koa (npm) 17 Jun

No fix available

GHSA-47p6-69vm-vw6v

npm/@koa/router

@koa/router has an Access Control Bypass 26 May

Fix available
Severity - 5.5 (Medium)

MAL-2026-2838

npm/koa-v3

Malicious code in koa-v3 (npm) 17 Apr

No fix available

GHSA-7gcc-r8m5-44qm

npm/koa

Koa has Host Header Injection via ctx.hostname 26 Feb

Fix available
Severity - 7.5 (High)

MAL-2025-185395

npm/aether-quantum-computing-koa-xanadu

Malicious code in aether-quantum-computing-koa-xanadu (npm) 13 Nov 2025

No fix available

MAL-2025-185892

npm/bootstrap-semantic-release-pulsar-koa

Malicious code in bootstrap-semantic-release-pulsar-koa (npm) 13 Nov 2025

No fix available

MAL-2025-186112

npm/changelog-middleware-koa-betelgeuse

Malicious code in changelog-middleware-koa-betelgeuse (npm) 13 Nov 2025

No fix available

MAL-2025-186285

npm/configstore-jabbah-koa-public

Malicious code in configstore-jabbah-koa-public (npm) 13 Nov 2025

No fix available

MAL-2025-186472

npm/dagda-ophiuchus-koa-solarnebula

Malicious code in dagda-ophiuchus-koa-solarnebula (npm) 13 Nov 2025

No fix available

MAL-2025-186517

npm/deimos-koa-build-figures

Malicious code in deimos-koa-build-figures (npm) 13 Nov 2025

No fix available

MAL-2025-186581

npm/development-rollup-pipe-koa

Malicious code in development-rollup-pipe-koa (npm) 13 Nov 2025

No fix available

MAL-2025-186688

npm/eigenstate-ophiuchus-sociobiology-koa

Malicious code in eigenstate-ophiuchus-sociobiology-koa (npm) 13 Nov 2025

No fix available

MAL-2025-187471

npm/ini-koa-adonis-astrometry

Malicious code in ini-koa-adonis-astrometry (npm) 13 Nov 2025

No fix available

MAL-2025-187567

npm/janus-centaurus-mutation-koa

Malicious code in janus-centaurus-mutation-koa (npm) 13 Nov 2025

No fix available

MAL-2025-187697

npm/koa-betelgeuse-luna-cassini

Malicious code in koa-betelgeuse-luna-cassini (npm) 13 Nov 2025

No fix available

MAL-2025-187698

npm/koa-callback-postcss-loader-webdriver-manager

Malicious code in koa-callback-postcss-loader-webdriver-manager (npm) 13 Nov 2025

No fix available

Vulnerabilities