MAL-2025-16781 Malicious code in change-object-path (npm)

The package change-object-path was found to contain malicious code...

change-object (0.0.0), cli-qa (2.0.0) +7 more potentially affected by unknown CVE via filter-stack (0.0.0)

filter-stack NPM version 0.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on filter-stack and may be impacted: - change-object 0.0.0 - cli-qa 2.0.0 - comma-list 0.0.0 - fd-select 1.0.0 - frp-tick 1.0.0 - innkeeper 1.0.4 - limited-parallel-loop 0.0.0 ...

Malicious code in change-object-path (npm)

The package change-object-path was found to contain malicious code...

change-object (0.0.0) potentially affected by unknown CVE via change-object-path (0.0.1)

change-object-path NPM version 0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on change-object-path and may be impacted: - change-object 0.0.0 Source cves: unknown CVE Source advisory: OSV:MAL-2025-16781...

brick-node (>=0.0.0, <=0.0.17), change-object (0.0.0) +8 more potentially affected by unknown CVE via stream-format (0.0.3)

stream-format NPM version 0.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on stream-format and may be impacted: - brick-node =0.0.0, =1.16.0, =0.0.0, =1.0.1 Source cves: unknown CVE Source advisory: OSV:MAL-2025-34079...

brick-node (>=0.0.0, <=0.0.17), change-object (0.0.0) +9 more potentially affected by unknown CVE via pause-function (0.0.1)

pause-function NPM version 0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pause-function and may be impacted: - brick-node =0.0.0, =1.16.0, =0.0.0, =1.0.1 - stream-format 0.0.3 Source cves: unknown CVE Source advisory: OSV:MAL-2025-28923...

Cross-Site Request Forgery (CSRF) in collectiveaccess/providence

Description I have found more endpoints which allow edit/duplicate were not protected from CSRF, the following endpoints are: 1: Edit Global Value in Pawtucket. 2: Change object type. 3: Duplicate object. 4: Duplicate items in the set and add to another set. Proof of Concept Via GET requests: 1...