Malicious Package in commander-js

All versions of commander-js are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads an arbitrary file and executes its contents as a post-install script. Recommendatio...

GHSA-2HQF-QQMQ-PGPP Malicious Package in commander-js

All versions of commander-js are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads an arbitrary file and executes its contents as a post-install script. Recommendatio...

@adobe/aem-site-template-builder (>=0.1.7, <=0.1.8), vulnerable-js (>=1.0.0, <=1.0.2) potentially affected by unknown CVE via bestzip (2.1.6)

bestzip NPM version 2.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on bestzip and may be impacted: - @adobe/aem-site-template-builder =0.1.7, =1.0.0, =1.0.2 Source cves: unknown CVE Source advisory: OSV:GHSA-4QQC-MP5F-CCV4...

@adobe/aem-site-template-builder (>=0.1.7, <=0.1.8), vulnerable-js (>=1.0.0, <=1.0.2) potentially affected by CVE-2020-7730 via bestzip (2.1.6)

bestzip NPM version 2.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on bestzip and may be impacted: - @adobe/aem-site-template-builder =0.1.7, =1.0.0, =1.0.2 Source cves: CVE-2020-7730 Source advisory: SNYK:JS-BESTZIP-609371...

Malicious Package

modlibrary is a malicious package. The package contains code that when executed in the browser, would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=...

Malicious Package

s3asy is a malicious package. The package contains code that when executed in the browser, would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl=...

PT-2020-20959

Name of the Vulnerable Software and Affected Versions commander-js versions all Description The commander-js package is malicious, designed to exploit typing mistakes when installing modules. Upon installation, it downloads and executes an arbitrary file as a post-install script. Recommendations...

PT-2020-21541

Name of the Vulnerable Software and Affected Versions serialize-to-js versions prior to 2.0.0 Description The issue is related to a Denial of Service, where user input is not properly validated. This allows attackers to provide inputs that cause the execution to loop indefinitely. Recommendations...

PT-2020-21217

Name of the Vulnerable Software and Affected Versions uglyfi-js version 3.4.6 Description The issue concerns a malicious package designed to exploit typographical errors when installing modules. Upon installation, it downloads and executes a file from a remote server, creating a backdoor. This...

Command Injection in kylefarris/clamscan

Overview clamscan is a Use Node JS to scan files on your server with ClamAV's clamscan binary or clamdscan daemon. This is especially useful for scanning uploaded files provided by un-trusted sources. This package are vulnerable to Command Injection, itt is possible to inject arbitrary commands a...

Malicious Package in ladder-text-js

ladder-text-js contained a malicious script that attempted to delete all files when npm test was run. Recommendation This module has been unpublished from the npm Registry. If you find this module in your environment remove it...

GHSA-353R-3V84-9PJJ Malicious Package in nothing-js

nothing-js contained a malicious script that attempted to delete all files when npm test was run. Recommendation This module has been unpublished from the npm Registry. If you find this module in your environment remove it...

Malicious Package in nginxbeautifier

Version 1.0.14 of nginxbeautifier contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 1.0.14 of this module is found installed yo...

GHSA-4C87-GG2Q-FC6M Malicious Package in rc-calendar-jhorst

Version 8.4.3 of rc-calendar-jhorst contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 8.4.3 of this module is found installed y...

Malicious Package in json-serializer

Version 2.0.10 of json-serializer contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 2.0.10 of this module is found installed yo...

GHSA-92PX-Q4W8-HRR5 Malicious Package in impala

Version 1.1.7 of impala contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 1.1.7 of this module is found installed you will want...

GHSA-3FV6-Q5XV-FHPW Malicious Package in coffee-project

Version 1.7.5 of coffee-project contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 1.7.5 of this module is found installed you...

Malicious Package in codify

Version 0.3.1 of codify contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 0.3.1 of this module is found installed you will want...

GHSA-8RXG-9G6F-VQ9P Malicious Package in another-date-range-picker

Version 4.1.48 of another-date-range-picker contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 4.1.48 of this module is found...

Malicious Package in @impala/bmap

Version 1.0.3 of @impala/bmap contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 1.0.3 of this module is found installed you wil...