Malicious code in harp-86myn-b5m8t-dusk-project (npm)

The package harp-86myn-b5m8t-dusk-project was found to contain malicious code...

Malicious code in zephyr-doa40-h7phj-harp-project (npm)

The package zephyr-doa40-h7phj-harp-project was found to contain malicious code...

Malicious code in universe-jq5lc-cp1s4-harp-project (npm)

The package universe-jq5lc-cp1s4-harp-project was found to contain malicious code...

Malicious code in harp-8uplv-sqsxc-harmony-project (npm)

The package harp-8uplv-sqsxc-harmony-project was found to contain malicious code...

MAL-2025-11956 Malicious code in @zalastax/nolb-harp (npm)

The package @zalastax/nolb-harp was found to contain malicious code...

MAL-2025-22240 Malicious code in harp-xru52-rref5-verdant-project (npm)

The package harp-xru52-rref5-verdant-project was found to contain malicious code...

MAL-2025-22237 Malicious code in harp-8dtdy-0fmvk-glow-project (npm)

The package harp-8dtdy-0fmvk-glow-project was found to contain malicious code...

Malicious code in harp-atlas-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 022ae8a7abfe3be6606aca88e7aa6a0c1f14c518c523a6652b335f01d520e3b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in harp-theme-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 001eaac73946b4fd360a3e1455f62b3a488a6080e68337409bb6ba1993bd40d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3564 Malicious code in harp-theme-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 001eaac73946b4fd360a3e1455f62b3a488a6080e68337409bb6ba1993bd40d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3563 Malicious code in harp-atlas-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 022ae8a7abfe3be6606aca88e7aa6a0c1f14c518c523a6652b335f01d520e3b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-9PR3-7449-977R Cross-Site Scripting in express-cart

All versions of harp are vulnerable to Cross-Site Scripting. In the admin page it is possible to inject arbitrary JavaScript as a new product option, allowing attackers to execute arbitrary code. This is limited to the admin page and does not affect other pages. Recommendation No fix is currently...

Cross-Site Scripting in express-cart

All versions of harp are vulnerable to Cross-Site Scripting. In the admin page it is possible to inject arbitrary JavaScript as a new product option, allowing attackers to execute arbitrary code. This is limited to the admin page and does not affect other pages. Recommendation No fix is currently...

GHSA-CX7R-634M-2Q2H Cross-Site Scripting in harp

Withdrawn This advisory has been withdrawn per request from the maintainer. Given harp is a static webserver, a XSS type of vulnerability is not appropriate. Original advisory description All versions of harp are vulnerable to Cross-Site Scripting. Due to misconfiguration of its rendering engine,...

Cross-Site Scripting in harp

Withdrawn This advisory has been withdrawn per request from the maintainer. Given harp is a static webserver, a XSS type of vulnerability is not appropriate. Original advisory description All versions of harp are vulnerable to Cross-Site Scripting. Due to misconfiguration of its rendering engine,...

@here/harp-leaflet (>=0.2.4, <=0.2.5) potentially affected by CVE-2020-8244 via bl (4.0.2)

bl NPM version 4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on bl and may be impacted: - @here/harp-leaflet =0.2.4, =0.2.5 Source cves: CVE-2020-8244 Source advisory: OSV:GHSA-PP7H-53GX-MX7R...

Unauthorized File Access in harp

All versions of harp are vulnerable to Unauthorized File Access. If a symlink in the project's base directory points to a file outside of the directory, the file is served. This could allow an attacker to access sensitive files on the server. Recommendation No fix is currently available. Consider...

@gkatsev/grunt-harp (>=0.18.0, <=0.19.0), @mobify/documentation-theme (>=1.11.3, <=2.0.0-preview.2-dev) +21 more potentially affected by CVE-2019-5438 via harp (>=0.9.5, <=0.32.0)

harp NPM version =0.9.5, =0.18.0, =1.11.3, =1.11.3, =0.0.3, =0.0.8-pre2, =0.0.1, =0.0.1, =0.0.1-1, =0.0.1, =0.1.0, =0.1.0, =0.2.9 - n-p-m 1.1.0 and more Source cves: CVE-2019-5438 Source advisory: OSV:GHSA-6FMM-47QC-P4M4...

GHSA-6FMM-47QC-P4M4 Unauthorized File Access in harp

All versions of harp are vulnerable to Unauthorized File Access. If a symlink in the project's base directory points to a file outside of the directory, the file is served. This could allow an attacker to access sensitive files on the server. Recommendation No fix is currently available. Consider...

@gkatsev/grunt-harp (>=0.18.0, <=0.19.0), @mobify/documentation-theme (>=1.11.3, <=2.0.0-preview.2-dev) +21 more potentially affected by CVE-2019-5437 via harp (>=0.9.5, <=0.32.0)

harp NPM version =0.9.5, =0.18.0, =1.11.3, =1.11.3, =0.0.3, =0.0.8-pre2, =0.0.1, =0.0.1, =0.0.1-1, =0.0.1, =0.1.0, =0.1.0, =0.2.9 - n-p-m 1.1.0 and more Source cves: CVE-2019-5437 Source advisory: OSV:GHSA-46HV-7769-J7RX...