Malicious Package

Overview mysql2.js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Allocation of Resources Without Limits or Throttling

Overview next is a react framework. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the fetchExternalImage function, which is used for image optimization and loads external images into memory without a maximum size limit. An attacker ca...

CVE-2025-59471

A denial of service vulnerability exists in self-hosted Next.js applications that have remotePatterns configured for the Image Optimizer. The image optimization endpoint /next/image loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause...

@4399ywkf/router (>=0.0.1, <=0.0.4), @akash-aw/aw-wizard-forms (4.14.0) +139 more potentially affected by CVE-2025-55184 +1 more via @modern-js/utils (>=2.65.2, <=2.70.4)

@modern-js/utils NPM version =2.65.2, =0.0.1, =1.0.0, =1.0.0, =0.44.0, =2.23.0, =0.3.53, =0.0.0-beta.1, =1.0.1, =0.30.0, =0.39.0 and more Source cves: CVE-2025-55184, CVE-2026-23864 Source advisory: SNYK:JS-MODERNJSUTILS-15120607...

CVE-2020-36956

Openfire 4.6.0 contains a stored cross-site scripting vulnerability in the nodejs plugin that allows attackers to inject malicious scripts through the 'path' parameter. Attackers can craft a payload with script tags to execute arbitrary JavaScript in the context of administrative users viewing th...

BIT-NODE-2025-55132

A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via futimes even when the process has only read permissions. Unlike utimes, futimes does not apply the expected write-permission checks, which means file metadata can be modified in read-only...

Exploit for Deserialization of Untrusted Data in Facebook React

🔍 Next.js Security Testing Tool Professiona...

@typebot.io/nextjs (>=0.3.23, <=0.6.0), @typebot.io/react (>=0.3.23, <=0.9.14) potentially affected by CVE-2025-65098 via @typebot.io/js (>=0.3.23, <=0.9.14)

@typebot.io/js NPM version =0.3.23, =0.3.23, =0.3.23, =0.9.14 Source cves: CVE-2025-65098 Source advisory: SNYK:JS-TYPEBOTIOJS-15060538...

@typebot.io/nextjs (>=0.3.23, <=0.6.0), @typebot.io/react (>=0.3.23, <=0.9.14) potentially affected by CVE-2025-65098 via @typebot.io/js (>=0.3.23, <=0.9.14)

@typebot.io/js NPM version =0.3.23, =0.3.23, =0.3.23, =0.9.14 Source cves: CVE-2025-65098 Source advisory: OSV:GHSA-4XC5-WFWC-JW47...

org.webjars.npm:solid-js (1.9.5) potentially affected by CVE-2026-24006 via org.webjars.npm:seroval (1.2.1)

org.webjars.npm:seroval MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:seroval and may be impacted: - org.webjars.npm:solid-js 1.9.5 Source cves: CVE-2026-24006 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15054528...

@aexol/opencode-tui (>=0.2.5, <=0.2.10), @agent-embed/js (>=0.0.1, <=2.1.0) +319 more potentially affected by CVE-2026-23956 via seroval (>=0.2.1, <=1.3.2)

seroval NPM version =0.2.1, =0.2.5, =0.0.1, =1.20.47, =2.11.0, =1.0.0, =1.0.0, =0.0.1, =0.0.1, =0.0.7, =0.0.1, =0.0.1, =1.0.0, =0.1.26, =0.1.38 and more Source cves: CVE-2026-23956 Source advisory: MEND:CVE-2026-23956...

CVE-2021-47860

GetSimple CMS Custom JS 0.1 plugin contains a cross-site request forgery vulnerability that allows unauthenticated attackers to inject arbitrary client-side code into administrator browsers. Attackers can craft a malicious website that triggers a cross-site scripting payload to execute remote cod...

CVE-2021-47860 GetSimple CMS Custom JS 0.1 - CSRF to XSS to RCE

GetSimple CMS Custom JS 0.1 plugin contains a cross-site request forgery vulnerability that allows unauthenticated attackers to inject arbitrary client-side code into administrator browsers. Attackers can craft a malicious website that triggers a cross-site scripting payload to execute remote cod...

CVE-2021-47860 GetSimple CMS Custom JS 0.1 - CSRF to XSS to RCE

GetSimple CMS Custom JS 0.1 plugin contains a cross-site request forgery vulnerability that allows unauthenticated attackers to inject arbitrary client-side code into administrator browsers. Attackers can craft a malicious website that triggers a cross-site scripting payload to execute remote cod...

CVE-2021-47860

GetSimple CMS Custom JS 0.1 plugin contains a cross-site request forgery vulnerability that allows unauthenticated attackers to inject arbitrary client-side code into administrator browsers. Attackers can craft a malicious website that triggers a cross-site scripting payload to execute remote cod...

org.webjars.npm:solid-js (1.9.5) potentially affected by CVE-2026-23957 via org.webjars.npm:seroval (1.2.1)

org.webjars.npm:seroval MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:seroval and may be impacted: - org.webjars.npm:solid-js 1.9.5 Source cves: CVE-2026-23957 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15054526...

org.webjars.npm:solid-js (1.9.5) potentially affected by CVE-2026-23737 via org.webjars.npm:seroval (1.2.1)

org.webjars.npm:seroval MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:seroval and may be impacted: - org.webjars.npm:solid-js 1.9.5 Source cves: CVE-2026-23737 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15054507...

org.webjars.npm:solid-js (1.9.5) potentially affected by CVE-2026-23736 via org.webjars.npm:seroval (1.2.1)

org.webjars.npm:seroval MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:seroval and may be impacted: - org.webjars.npm:solid-js 1.9.5 Source cves: CVE-2026-23736 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15054524...

Malicious Package

Overview replicate-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in replicate-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f84c6cb090eb31f1b2c516b45419d7833bca83f5546d22444032d28a07d27f40 The package replicate-js was found to contain malicious code. Source: ghsa-malware 658bf1d6aa22bb672e5ae9724e34b94ee7ff73e7cd4381ff4a6a8c9c2d1267fa A...