tpr (>=0.2.0, <=0.2.2) potentially affected by CVE-2016-10634 via scalajs-standalone-bin (0.4.3)

scalajs-standalone-bin NPM version 0.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on scalajs-standalone-bin and may be impacted: - tpr =0.2.0, =0.2.2 Source cves: CVE-2016-10634 Source advisory: OSV:GHSA-CVX3-PQMJ-X57X...

CVE-2016-10634

scala-standalone-bin is a Binary wrapper for ScalaJS. scala-standalone-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacke...

CVE-2016-10634

CVE-2016-10634 affects the scalajs-standalone-bin Binary wrapper for ScalaJS. The issue: the component downloads binary resources over HTTP, enabling MITM interception; an attacker on the network could swap the requested binary with a malicious one, potentially causing remote code execution on th...