Malicious code in query-string-cjs (npm)

--- -= Per source details. Do not edit below this line.=-...

ses-cjs (>=1.0.0 <=1.0.1) potentially affected by CVE-2023-39532 via ses (=0.13.1)

ses NPM version =0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on ses and may be impacted: - ses-cjs =1.0.0, =1.0.1 Source cves: CVE-2023-39532 Source advisory: OSV:GHSA-9C4H-3F7H-322R...

Malicious code in chalk-animate-cjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 516c8dd53eb3c24c892eed50063a6f315dc748a4d2f006d392d7ec6785802d0b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-168 Malicious code in chalk-animate-cjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 516c8dd53eb3c24c892eed50063a6f315dc748a4d2f006d392d7ec6785802d0b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview query-string-cjs is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

cortex-cli (>=2.0.8 <=2.1.1) potentially affected by CVE-2022-36083 via jose-node-cjs-runtime (>=4.10.0 <=4.8.1)

jose-node-cjs-runtime NPM version =4.10.0, =2.0.8, =2.1.1 Source cves: CVE-2022-36083 Source advisory: OSV:GHSA-JV3G-J58F-9MQ9...

cjs-forms (>=0.0.1 <=1.0.0), output-customization (=1.0.0) potentially affected by unknown CVE via @ve-private/test-helpers (=0.0.1-security.9)

@ve-private/test-helpers NPM version =0.0.1-security.9 is affected by a known vulnerability. The following packages have a transitive dependency on @ve-private/test-helpers and may be impacted: - cjs-forms =0.0.1, =1.0.0 - output-customization =1.0.0 Source cves: unknown CVE Source advisory:...

Padding Oracle Attack

jose-node-cjs-runtime is vulnerable to padding oracle attack. The vulnerability exists as decryption did not fail as soon as hmac verification fails, allowing timing information to be measured by running the CBC decryption with various padding length...

CVE-2021-29446 Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-cjs-runtime

jose-node-cjs-runtime is an npm package which provides a number of cryptographic functions. In versions prior to 3.11.4 the AESCBCHMACSHA2 Algorithm A128CBC-HS256, A192CBC-HS384, A256CBC-HS512 decryption would always execute both HMAC tag verification and CBC decryption, if either failed...