196473 matches found
pmg
Package Manager Guard PMG Bloquea paquetes maliciosos de npm y pip antes de que se instalen. Defensa en profundidad para los gestores de paquetes que ya utilizas...
pmg
Package Manager Guard PMG Block malicious npm and pip packages before they install. Defense in depth for the package managers you already use...
CVE-2025-29927
CVE-2025-29927 在 Next.js 15.2.0 中的漏洞 运行方法： root@kitploit: git clone https://github.com/nyctophile0969/CVE-2025-29927 cd CVE-2025-29927 npm install [email protected] npm run dev...
CVE-2024-21533-PoC-ggit
CVE-2024-21533 Argument Injection vulnerability in ggit ggit describes itself as: root@kitploit: Local promise-returning git command wrappers Resources: Project's GitHub source code: https://github.com/bahmutov/ggit Project's npm package: https://www.npmjs.com/package/ggit Article write-up on thi...
MAL-2026-16345 Malicious code in starbucks-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f42de3e225b6f8d6be04fbf613ae4d17458626c92f2cfe1bf1b4476fe132e761 The package's package.json declares a preinstall script that runs callback.js on npm install. callback.js collects os.hostname, os.userInfo,...
Malicious code in starbucks-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f42de3e225b6f8d6be04fbf613ae4d17458626c92f2cfe1bf1b4476fe132e761 The package's package.json declares a preinstall script that runs callback.js on npm install. callback.js collects os.hostname, os.userInfo,...
Malicious code in radio-player-theme (npm)
radio-player-theme presents itself as a radio player theme. The published tarball contains three files: package.json, style.css declared as main and payload.js, which holds the package's only executable code. payload.js is a browser payload. On execution it reads location.origin and...
MAL-2026-16347 Malicious code in radio-player-theme (npm)
radio-player-theme presents itself as a radio player theme. The published tarball contains three files: package.json, style.css declared as main and payload.js, which holds the package's only executable code. payload.js is a browser payload. On execution it reads location.origin and...
CVE-2021-44906
CVE-2021-44906 原出处：https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip 运行 root@kitploit: npm run hack 然后你会看到任意函数的 done 属性被改为 true。 命令行 node index.js --.concat.constructor.prototype.done true 的解释： -- 是命令行参数中常用的连字符标记。 是 minimist...
vigolium v0.4.8
Vigolium - High-fidelity vulnerability scanner fusing agentic AI with native speed, modularity, and precision Vigolium provides two complementary scanning modes: Native Scan vigolium scan: Fast, powerful, and flexible. Deterministic, multi-phase scanning with 317 modules across content discovery,...
React2Shell-CVE-2025-55182
HackIndex.IO - React2Shell - CVE-2025-55182 + CVE-2025-66478 Un entorno sandbox de HackIndex.io para la vulnerabilidad React2Shell. Esto iniciará una aplicación web en el puerto 3000 y un servidor SSH en el puerto 2222. Iniciar el entorno root@kitploit: docker compose up --build --force-recreate...
CVE-2023-45827
CVE-2023-45827 漏洞概述 CVE-2023-45827 CVSS : 9.8 Nov 3, 2023 ProtoType Pollution in node.js package 作为 rebob 项目的一部分 漏洞描述 github advisories 这是 dot-diver 中的一个原型污染PP漏洞。它可能导致 RCE。 漏洞代码 root@kitploit: //https://github.com/clickbar/dot-diver/tree/main/src/index.ts:277 //eslint-disable-next-line...
ReactNext2Shell
es-define-property Object.defineProperty, but not IE 8's broken one...
CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories
An attacker copied about 170 of CrowdSec's private GitHub repositories on May 22 using the account of an employee who had just left, CrowdSec said on September 18. The French security company had kept his GitHub access open. CrowdSec says his laptop was compromised in May's supply chain attack on...
next-bug-CVE-2025-55182
用於復現 CVE-2025-55182 npm run dev npm run exploit.js // 模擬惡意攻擊...
lodash.template-fixed
lodash.template v4.5.0 El método .template de Lodash exportado como un módulo de Node.js. Instalación Usando npm: root@kitploit: $ sudo -H npm i -g npm $ npm i --save lodash.template En Node.js: root@kitploit: var template = require'lodash.template'; Consulte la documentación o el código fuente d...
The vulnerability of the NPM packet manager’s vm2 library, related to a flaw in the data protection mechanism, allows attackers to execute arbitrary code.
The vulnerability of the NPM packet manager’s library vm2 is related to a breach in data protection mechanisms. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...
The vulnerability of the NPM packet manager’s vm2 library, related to improper code generation management, allows an attacker to execute arbitrary code.
The vulnerability of the NPM package manager’s vm2 library is related to incorrect code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the NPM packet manager’s vm2 library, related to improper code generation management, allows an attacker to execute arbitrary code.
The vulnerability of the NPM package manager’s vm2 library is related to incorrect code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the NPM packet manager’s vm2 library, related to a flaw in the data protection mechanism, allows attackers to execute arbitrary code.
The vulnerability of the NPM packet manager’s library vm2 is related to a breach in data protection mechanisms. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...