grocery_app (1.0.0) potentially affected by CVE-2025-67419 via @evershop/evershop (2.2.1)

@evershop/evershop NPM version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on @evershop/evershop and may be impacted: - groceryapp 1.0.0 Source cves: CVE-2025-67419 Source advisory: SNYK:JS-EVERSHOPEVERSHOP-14872349...

GHSA-32R3-57HP-CGFW EverShop at risk to unauthorized access via weak HMAC secret

An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.9. The HMAC secret used for generating tokens is hardcoded as "secret". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens JWTs, allowing them access t...

CVE-2023-46943

An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. The HMAC secret used for generating tokens is hardcoded as "secret". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens JWTs, allowing them access t...