eslint-config-vascular (>=0.0.1, <=0.0.3), udger-updater-nodejs (>=1.0.0, <=1.0.2) potentially affected by CVE-2018-3722 via merge-deep (3.0.0)

merge-deep NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on merge-deep and may be impacted: - eslint-config-vascular =0.0.1, =1.0.0, =1.0.2 Source cves: CVE-2018-3722 Source advisory: OSV:GHSA-9G9W-HMVJ-5H57...

Malicious Package

Overview Version 2.0.0 of eslint-config-airbnb-standard was published with a bundled version of eslint-scope that was found to contain malicious code. This code would read the users .npmrc file and send it's contents to a remote server. Recommendation The best course of action if you found this...

Malicious Package

A malicious version of eslint-scope has been published onto the npm registry. This malicious version attempts to steal the user's npm authentication token from .npmrc through a postinstall script specified in package.json. Successful attempts would result in compromised authentication tokens...

Malicious Package in eslint-scope

Version 3.7.2 of eslint-scope was published without authorization and was found to contain malicious code. This code would read the users .npmrc file and send any found authentication tokens to 2 remote servers. Recommendation The best course of action if you found this package installed in your...

GHSA-HXXF-Q3W9-4XGW Malicious Package in eslint-scope

Version 3.7.2 of eslint-scope was published without authorization and was found to contain malicious code. This code would read the users .npmrc file and send any found authentication tokens to 2 remote servers. Recommendation The best course of action if you found this package installed in your...

Malicious Package

Overview Version 5.0.2 of eslint-config-eslint was published without authorization and was found to contain malicious code. This code would read the users .npmrc file and send any found authentication tokens to a remote server. Recommendation The best course of action if you found this package...

Malicious Package

Overview Version 3.7.2 of eslint-scope was published without authorization and was found to contain malicious code. This code would read the users .npmrc file and send any found authentication tokens to 2 remote servers. Recommendation The best course of action if you found this package installed...

PT-2018-19173

Name of the Vulnerable Software and Affected Versions eslint-scope version 3.7.2 Description The issue concerns malicious code in a specific version of eslint-scope. This code reads the user's .npmrc file and sends any found authentication tokens to remote servers. Recommendations Revoke all npm...

Malicious JavaScript Package Detection

Detection and reporting of known malicious JavaScript packages or package versions. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescripti...

Regular Expression Denial Of Service (ReDoS)

eslint is vulnerable to regular expression denial of service ReDoS attacks. These attacks are possible because there is catastrophic backtracking in the regex used to interpolate keys from an object in markers...

await vs return vs return await

When writing async functions, there are differences between await vs return vs return await, and picking the right one is important. Let's start with this async function: async function waitAndMaybeReject // Wait one second await new Promiser = setTimeoutr, 1000; // Toss a coin const isHeads =...