revera

Revera npmパッケージの信用スコア。 Reveraは、npm installを実行する前にパッケージをインストールする価値があるかどうかの判断を支援します。パッケージ品質、メンテナンス、セキュリティ、エコシステムの健全性、パブリッシャーの信頼性を分析し、依存関係グラフ全体にリスクを推移的に伝播させて、説明可能なベイズ流のレピュテーションレポートを生成します。 デモ reveraがパッケージをリアルタイムで検査・解説する様子をご覧ください。 クイックスタート インストール不要ですぐにreveraを実行： npx revera check react 例...

MINI-WF6V-8Q23-WW72

Bulletin has no description...

GO-2023-1795 vulnerabilities

Vulnerabilities for packages: skaffold, aactl...

Malicious Package

Overview cilm-ui-commons is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @hzero-front-ui/themes is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview node-config-svg-contract is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview eslint-generate-prerelease is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview eslint-publish-release is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview datetime-fmt-xutil is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview postcss-initial-provider is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview iconova-react is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview cubesat-upstream-driver is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

@whalent/agent (0.3.282) potentially affected by unknown CVE via @whalent/agent-core (0.3.282)

@whalent/agent-core NPM version 0.3.282 is affected by a known vulnerability. The following packages have a transitive dependency on @whalent/agent-core and may be impacted: - @whalent/agent 0.3.282 Source cves: unknown CVE Source advisory: SNYK:JS-WHALENTAGENTCORE-18565245...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Malicious Package

Overview @marketfront/fingerprint is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

MAL-2026-10421 Malicious code in portway (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e04dc52cd77658d168578535fb67d77ea76de79beadb77e14c96f023f4e51772 package.json declares the dependency 'ltidisafe' as a direct https tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.3.2.tgz...

MAL-2026-6345 Malicious code in thurdweb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 775ff15f4a1314978d4cfed1e97c6c9ac8621d8ddeed93160c25aa3681f73cc7 Package name thurdweb is a one-character substitution of the popular web3 SDK thirdweb, but the shipped source is a copy of MikeMcl/big.js...

Malicious code in ts-sudo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a6e18b2d6bef04dd8377fac8d9b20e5545f1ec39875fdd308adf118b6f319d1 The package publishes under the name ts-sudo but ships a verbatim copy of the big.js v7.0.1 source big.js, big.mjs along with big.js's description,...

Malicious code in vite-common-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1d3397d754ffeb3726496769b2f159ce8596b2233b5875afa8f7fbca29ed0fd The package presents itself as a Vite utility library but its only export, loadFilbetScriptSilently, creates a element whose src is hardcoded to...

MAL-2026-4465 Malicious code in @web-3d-tool/sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1e96a726cf0732113215b2026a7a59fc6bf471f86d34153fea3a0e32b275fb5 @web-3d-tool/sdk is a near-empty package trivial 35-byte index.js, empty author/description metadata whose only effect on install is to pull in a...