Malicious code in dws-frontend-dws-frontend-core (npm)

Source: amazon-inspector 7fb73f65c18cf45f29f533ef6b9ab1278412909686c0750018f9d35170ed39f2 On require of this package, index.js loads support.js which downloads a platform-specific binary over HTTPS from author-controlled hosts under oob-worker.cf1.workers.dev with a DNS TXT-record base64 fallback...

@budibase/client (>=0.0.999-alpha.30, <=3.2.26), @budibase/server (>=0.0.999-alpha.30, <=3.2.26) potentially affected by CVE-2026-48148 via @budibase/frontend-core (>=0.0.999-alpha.30, <=3.2.26)

@budibase/frontend-core NPM version =0.0.999-alpha.30, =0.0.999-alpha.30, =0.0.999-alpha.30, =3.2.26 Source cves: CVE-2026-48148 Source advisory: MEND:CVE-2026-48148...

Malware in @limebike/frontend-core-api

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @limebike/frontend-core-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36e6a8b7768f00cc5d468fe7a21f8792da1970b60e5ccbad17eefeda1a8d5b3d Package squats the @limebike npm scope and ships a preinstall/postinstall hook node index.js that, on npm install, collects hostname, non-internal...

Improper Privilege Management

Overview @budibase/frontend-core is a Budibase frontend core libraries used in builder and client Affected versions of this package are vulnerable to Improper Privilege Management through the onboardUsers function. An attacker can gain unauthorized administrative privileges by sending crafted...

@budibase/client (>=3.0.0, <=3.2.26), @budibase/server (>=3.0.0, <=3.2.26) potentially affected by CVE-2026-45716 via @budibase/frontend-core (>=3.0.0, <=3.2.26)

@budibase/frontend-core NPM version =3.0.0, =3.0.0, =3.0.0, =3.2.26 Source cves: CVE-2026-45716 Source advisory: SNYK:JS-BUDIBASEFRONTENDCORE-16759691...

Malware in @casaverso/frontend-core

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview @casaverso/frontend-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious code in @casaverso/frontend-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48584fd15701448c3394285943de2520455a7b1fc07cead90b74d535437feda4 The package @casaverso/frontend-core was found to contain malicious code. Source: ghsa-malware...

MAL-2026-628 Malicious code in @casaverso/frontend-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48584fd15701448c3394285943de2520455a7b1fc07cead90b74d535437feda4 The package @casaverso/frontend-core was found to contain malicious code. Source: ghsa-malware...

MAL-2023-8105 Malicious code in purplebricks-frontend-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f8044c661c6223ef46436635423b8c74bbebf2796ae2252435a5592288dceca7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in purplebricks-frontend-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f8044c661c6223ef46436635423b8c74bbebf2796ae2252435a5592288dceca7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in purplebricks-frontend-core

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

@budibase/client (>=1.1.32-alpha.0, <=1.3.19-alpha.7), @budibase/frontend-core (>=1.1.32-alpha.0, <=1.3.19-alpha.7) +1 more potentially affected by CVE-2022-3225 via @budibase/bbui (>=1.1.32-alpha.0, <=1.3.19-alpha.7)

@budibase/bbui NPM version =1.1.32-alpha.0, =1.1.32-alpha.0, =1.1.32-alpha.0, =1.1.32-alpha.0, =1.3.19-alpha.7 Source cves: CVE-2022-3225 Source advisory: GHSA-X92G-49GH-63QM...

@budibase/client (>=0.0.999-alpha.30, <=1.3.19-alpha.7), @budibase/frontend-core (>=0.0.1, <=1.3.19-alpha.7) +4 more potentially affected by CVE-2022-3225 via @budibase/bbui (>=0.0.1, <=1.3.19-alpha.7)

@budibase/bbui NPM version =0.0.1, =0.0.999-alpha.30, =0.0.1, =0.0.999-alpha.30, =0.9.1, =0.9.123, =0.9.124 - @operabuild/standard-components 0.9.124 Source cves: CVE-2022-3225 Source advisory: MEND:CVE-2022-3225...

Malicious Package

Overview @logistics-frontend/core is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious Package

Overview flipper-frontend-core is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

flipper-server (>=0.171.1, <=0.212.0), flipper-server-companion (>=0.171.0, <=0.212.0) +1 more potentially affected by unknown CVE via flipper-frontend-core (>=0.171.0, <=0.212.0)

flipper-frontend-core NPM version =0.171.0, =0.171.1, =0.171.0, =0.171.1, =0.212.0 Source cves: unknown CVE Source advisory: OSV:MAL-2022-3074...

Malicious code in flipper-frontend-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 745d70c1af1c5bc8882038e6eac687fd4ce85fa2d6b667c7c5ccef39ce54b877 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in flipper-frontend-core

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...