Malicious code in metadata-ipfs-pack (npm)

The package metadata-ipfs-pack was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: minio, opentelemetry-collector-contrib-fips, kubo, zot, amass, helm-operator-fips, wavefront-collector-for-kubernetes, boring-registry, yace, migrate, tekton-pipelines-fips, kube-bench-fips, kyverno-policy-reporter-fips, harbor, terraform, witness,...

@0xvaibhav/divergent-node (>=0.0.1, <=0.0.3), @0xvaibhav/ipfs-messenger (>=1.0.3, <=1.0.9) +402 more potentially affected by CVE-2025-8020 via private-ip (3.0.2)

private-ip NPM version 3.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on private-ip and may be impacted: - @0xvaibhav/divergent-node =0.0.1, =1.0.3, =0.0.1, =0.0.2, =9.3.0, =1.0.0, =1.3.2, =1.0.1, =1.0.1, =1.1.0, =1.0.2, =1.0.3 -...

GHSA-F26W-GH5M-QQ77 vulnerabilities

Vulnerabilities for packages: k3s, ipfs-cluster-fips...

CVE-2025-49140 vulnerabilities

Vulnerabilities for packages: k3s, ipfs-cluster-fips...

CVE-2022-47933

Brave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a crafted HTML file that references the IPFS scheme. This vulnerability is caused by an uncaught exception in the function ipfs::OnBeforeURLRequestIPFSRedirectWork in ipfsredirectnetworkdelegatehelper.cc...

CVE-2022-47932

Brave Browser before 1.43.34 allowed a remote attacker to cause a denial of service via a crafted HTML file that mentions an ipfs:// or ipns:// URL. This vulnerability is caused by an incomplete fix for CVE-2022-47933...

CVE-2020-10937

An issue was discovered in IPFS aka go-ipfs 0.4.23. An attacker can generate ephemeral identities Sybils and leverage the IPFS connection management reputation system to poison other nodes' routing tables, eclipsing the nodes that are the target of the attack from the rest of the network. Later...

CVE-2020-26283

go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0, control characters are not escaped from console output. This can result in hiding input from the user which could result in the user taking an unknown,...

CVE-2025-27144 vulnerabilities

Vulnerabilities for packages: grafana-alloy, minio, steampipe, podman, argo-workflows, distribution, gomplate, grpc-health-probe, dex, dagger, spire-server, hydra, gatus, vexctl, opentofu, harbor-registry, sftpgo-plugin-kms, rook, step-ca, apko, neuvector-scanner, zarf, kyverno-notation-aws, tkn,...

GHSA-C6GW-W398-HV78 vulnerabilities

Vulnerabilities for packages: grafana-alloy, minio, steampipe, podman, argo-workflows, distribution, gomplate, grpc-health-probe, dex, dagger, spire-server, hydra, gatus, vexctl, opentofu, harbor-registry, sftpgo-plugin-kms, rook, step-ca, apko, neuvector-scanner, zarf, kyverno-notation-aws, tkn,...

CVE-2020-26279

go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0-rc1, it is possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten, or written t...

CVE-2024-53259 vulnerabilities

Vulnerabilities for packages: cloudflared, spegel, buf, traefik-fips, q, kubernetes-dns-node-cache, eks-distro-fips, frp, caddy, eks-distro, caddy-fips, k3s, traefik, kubernetes-dns-node-cache-fips...

GHSA-MQR9-HJR8-2M9W Content Censorship in the InterPlanetary File System (IPFS) via Kademlia DHT abuse

The Kademlia DHT go-libp2p-kad-dht 0.20.0 and earlier used in IPFS 0.18.1 and earlier assigns routing information for content i.e., information about who holds the content to be stored by peers whose peer IDs have a small DHT distance from the content ID. This allows an attacker to censor content...

Content Censorship in the InterPlanetary File System (IPFS) via Kademlia DHT abuse

The Kademlia DHT go-libp2p-kad-dht 0.20.0 and earlier used in IPFS 0.18.1 and earlier assigns routing information for content i.e., information about who holds the content to be stored by peers whose peer IDs have a small DHT distance from the content ID. This allows an attacker to censor content...

CVE-2023-26248

The Kademlia DHT go-libp2p-kad-dht 0.20.0 and earlier used in IPFS 0.18.1 and earlier assigns routing information for content i.e., information about who holds the content to be stored by peers whose peer IDs have a small DHT distance from the content ID. This allows an attacker to censor content...

CVE-2023-26248

The Kademlia DHT go-libp2p-kad-dht 0.20.0 and earlier used in IPFS 0.18.1 and earlier assigns routing information for content i.e., information about who holds the content to be stored by peers whose peer IDs have a small DHT distance from the content ID. This allows an attacker to censor content...

CVE-2023-26248

The Kademlia DHT go-libp2p-kad-dht 0.20.0 and earlier used in IPFS 0.18.1 and earlier assigns routing information for content i.e., information about who holds the content to be stored by peers whose peer IDs have a small DHT distance from the content ID. This allows an attacker to censor content...

CVE-2023-26248

The Kademlia DHT go-libp2p-kad-dht 0.20.0 and earlier used in IPFS 0.18.1 and earlier assigns routing information for content i.e., information about who holds the content to be stored by peers whose peer IDs have a small DHT distance from the content ID. This allows an attacker to censor content...

CVE-2023-26248

The Kademlia DHT go-libp2p-kad-dht 0.20.0 and earlier used in IPFS 0.18.1 and earlier assigns routing information for content i.e., information about who holds the content to be stored by peers whose peer IDs have a small DHT distance from the content ID. This allows an attacker to censor content...