jl-wechat-sdk (>=1.0.0, <=1.2.3) potentially affected by unknown CVE via crpyto-js (0.0.1-security)

crpyto-js NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on crpyto-js and may be impacted: - jl-wechat-sdk =1.0.0, =1.2.3 Source cves: unknown CVE Source advisory: OSV:GHSA-73C6-VWJH-G3QH...

Malicious Package in crpyto-js

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated...

Malicious Package in crytpo-js

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated...

Insecure Random

crypto-js uses an insecure random. An attacker is able to guess and discover generated values due to biasness in the secureRandom function...