Malicious Package

Overview mapray-js-monorepo is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packag...

Malicious Package

Overview ethers-js-snap is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package wa...

Malicious Package

Overview oms-js-utils is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Malicious Package

Overview ddc-classnames-js is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

Malicious code in ethmoji-js-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 34b3e9fb116b32c332ccbd4ad178a22a8aad613494a223d2fba755ff689eaad1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2877 Malicious code in ethmoji-js-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 34b3e9fb116b32c332ccbd4ad178a22a8aad613494a223d2fba755ff689eaad1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

react-native-url-preview (1.1.9), react-native-url-preview-tgp (1.1.9) +1 more potentially affected by CVE-2022-25876 via link-preview-js (>=2.0.4, <=2.1.13)

link-preview-js NPM version =2.0.4, =2.1.4, =2.2.0 Source cves: CVE-2022-25876 Source advisory: SNYK:JS-LINKPREVIEWJS-2933520...

Server-side Request Forgery (SSRF)

Overview link-preview-js is a Javascript module to extract and fetch HTTP link information from blocks of text. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF which allows attackers to send arbitrary requests to the local network and read the response. This i...

WordPress Download Manager 3.2.43 Cross Site Scripting

Exploit Title: Download Manager Cross-Site Scripting Date: 2022-06-16 Exploit Author : Andrea Bocchetti Vendor Homepage : https://wordpress.org/plugins/download-manager/ Version : = 3.2.43 Tested on: windows CVE : CVE-2022-2101 Description 1- Login in the plugin page 2- add the xss payload in the...

nodejs: Incorrect handling of certificate subject and issuer fields

A flaw was found in node.js, where it did not properly handle multi-value Relative Distinguished Names. This flaw allows a specially crafted x509 certificate to produce a false multi-value Relative Distinguished Name and to inject arbitrary data in node.js libraries...

Malicious code in cart-client-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e2856576c4df628bed193bb9ad1d6223d7ac9f81f4e5592cfe77c531f9bfcf4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1833 Malicious code in cart-client-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e2856576c4df628bed193bb9ad1d6223d7ac9f81f4e5592cfe77c531f9bfcf4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in medicare-common-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f29c05d6cee577d5f86a2a760c23578b65068f7e091dc6519990f798f42d30a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4539 Malicious code in medicare-common-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f29c05d6cee577d5f86a2a760c23578b65068f7e091dc6519990f798f42d30a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hb-analytics-js-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12eee3dc0ffc0d3745b6a4c59df442b805eb59386b63660250622af4f839abc5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3570 Malicious code in hb-analytics-js-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12eee3dc0ffc0d3745b6a4c59df442b805eb59386b63660250622af4f839abc5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @boosted-bounty/firebase-helpers-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 948a8d680d689630aad1614e4a8b58cad4c431fb2d9e87887c4055879595ae95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-143 Malicious code in @boosted-bounty/firebase-helpers-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 948a8d680d689630aad1614e4a8b58cad4c431fb2d9e87887c4055879595ae95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in amazon-kinesis-video-streams-webrtc-sdk-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a41c304fc95ca7e20537b9ac25674c0c7e230f44bf650764c923be4cfdf37cf3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-955 Malicious code in amazon-kinesis-video-streams-webrtc-sdk-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a41c304fc95ca7e20537b9ac25674c0c7e230f44bf650764c923be4cfdf37cf3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...