Malware in apollo-landing

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview apollo-landing is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

8base-cli (>=0.0.80, <=0.0.90), @awoyotoyin/ts-graphql-yoga-express-starter (1.0.0) +133 more potentially affected by unknown CVE via apollo-server-lambda (>=1.3.2, <=2.11.0)

apollo-server-lambda NPM version =1.3.2, =0.0.80, =0.1.0-latest.30e51283, =0.1.0, =0.1.1, =1.0.0, =0.0.1-beta, =1.0.0, =1.7.0, =0.0.4, =0.0.1, =0.0.1-alpha.13, =0.0.1-alpha.12, =0.0.1-alpha.12.5 and more Source cves: unknown CVE Source advisory: MEND:WS-2020-0116...

WS-2020-0116

Apollo-server-lambda before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable...

WS-2020-0115

Apollo-server-micro before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable nam...

codelift (>=0.6.3-canary.85.acbf24c.0, <=1.0.15-canary.394.652cc97.0), graphql-server-micro (>=1.0.2, <=1.4.1) +8 more potentially affected by unknown CVE via apollo-server-micro (>=1.4.0, <=2.14.1)

apollo-server-micro NPM version =1.4.0, =0.6.3-canary.85.acbf24c.0, =1.0.2, =1.0.0, =1.0.0, =2.0.0, =1.5.8, =0.1.0, =0.1.0, =1.0.0-rc.3, =1.0.0-rc.5 Source cves: unknown CVE Source advisory: MEND:WS-2020-0115...

@axelspringer/mango-api (>=0.0.1-alpha, <=1.0.0-beta.75), @carlosbajo/graphql-gateway (>=1.2.0, <=2.4.62) +49 more potentially affected by unknown CVE via apollo-server-koa (>=1.3.6, <=2.9.12)

apollo-server-koa NPM version =1.3.6, =0.0.1-alpha, =1.2.0, =2.8.1, =2.4.8, =0.2.1, =0.5.1, =0.2.1, =0.5.1, =0.2.6, =0.1.2, =0.1.6, =0.3.10, =0.3.10, =6.1.0, =1.0.1, =1.0.2 and more Source cves: unknown CVE Source advisory: MEND:WS-2020-0114...

WS-2020-0114

Apollo-server-koa before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable names...

WS-2020-0113

Apollo-server-hapi before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable name...

@bakjs/graphql (>=2.0.0, <=2.2.0), @clevyr/pavo-hapi-graphql (>=0.0.1, <=0.0.5) +14 more potentially affected by unknown CVE via apollo-server-hapi (>=1.2.0, <=1.4.0)

apollo-server-hapi NPM version =1.2.0, =2.0.0, =0.0.1, =0.1.0, =1.0.0, =0.0.51, =3.0.0, =1.0.2, =1.0.1, =0.2.2, =0.2.37 - trailpack-apollo 3.0.0-alpha.0 and more Source cves: unknown CVE Source advisory: MEND:WS-2020-0113...

WS-2020-0112

Apollo-server-fastify before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable...

WS-2020-0111

Apollo-server-express before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable...

@0x18b2ee/parse-server (>=3.10.1, <=3.11.0), @3wks/gae-node-nestjs (>=0.1.3, <=5.2.0-rc3) +479 more potentially affected by unknown CVE via apollo-server-express (>=1.0.5, <=2.14.1)

apollo-server-express NPM version =1.0.5, =3.10.1, =0.1.3, =0.1.1, =2.0.0, =0.1.0, =0.1.0, =0.3.0-SNAPSHOT1, =0.5.0-rc1, =0.3.0-SNAPSHOT1, =0.5.2-dev1, =2018.8.28-0, =0.0.1-0.0.7.0, =1.1.8 and more Source cves: unknown CVE Source advisory: MEND:WS-2020-0111...

WS-2020-0110

Apollo-server-cloudflare before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readabl...

WS-2020-0109

Apollo-server-cloud-functions before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and...

WS-2020-0108

Apollo-server-core before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and human-readable name...

WS-2020-0107

Apollo-server-cache-memcached before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and...

8base-cli (>=0.0.80, <=0.0.90), @3wks/gae-node-nestjs (>=0.1.3, <=5.2.0-rc3) +579 more potentially affected by unknown CVE via apollo-server-core (>=1.3.2, <=2.12.0)

apollo-server-core NPM version =1.3.2, =0.0.80, =0.1.3, =0.1.1, =0.1.0, =0.1.0, =0.3.0-SNAPSHOT1, =0.5.0-rc1, =0.3.0-SNAPSHOT1, =0.5.2-dev1, =2018.8.28-0, =0.5.1-alpha.0, =0.0.1-0.0.7.0, =2.11.0, =3.0.0 and more Source cves: unknown CVE Source advisory: MEND:WS-2020-0108...

WS-2020-0106

Apollo-server-azure-functions before 2.4.12 is vulnerable to Information Exposure. The package does not properly enforce validation rules when creating subscription servers, which includes a NoInstrospection rule for the Websocket. This leaks the GraphQL schema types, their relations and...

@24hr/rawb-search (>=0.10.1, <=0.29.10), @aerogear/apollo-voyager-keycloak (>=0.1.0, <=0.2.7-rc3) +78 more potentially affected by unknown CVE via apollo-server (>=0.1.5, <=2.14.1)

apollo-server NPM version =0.1.5, =0.10.1, =0.1.0, =0.1.0, =0.3.0-SNAPSHOT1, =0.5.0-rc1, =0.3.0-SNAPSHOT1, =2018.8.29-0, =2018.8.28-0, =0.5.7, =1.0.0, =0.0.1-alpha.44, =0.4.0, =0.10.3 - @graphql-cli/serve 4.0.1-alpha-d18495f.0 and more Source cves: unknown CVE Source advisory: MEND:WS-2020-0105...