@baosight/xinrong (>=0.0.36, <=0.0.37), npm_1st_publish (1.0.0) +1 more potentially affected by unknown CVE via jqeury (0.0.1-security)

jqeury NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on jqeury and may be impacted: - @baosight/xinrong =0.0.36, =0.0.37 - npm1stpublish 1.0.0 - wypulldom 1.0.0 Source cves: unknown CVE Source advisory: GHSA-7F24-QHQG-R8RV...

Malicious code in jqeury (npm)

The package jqeury was found to contain malicious code. --- Credit: OpenSSF source...

@baosight/xinrong (>=0.0.36, <=0.0.37), npm_1st_publish (1.0.0) +1 more potentially affected by unknown CVE via jqeury (0.0.1-security)

jqeury NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on jqeury and may be impacted: - @baosight/xinrong =0.0.36, =0.0.37 - npm1stpublish 1.0.0 - wypulldom 1.0.0 Source cves: unknown CVE Source advisory: OSV:MAL-2025-23891...

MAL-2025-23891 Malicious code in jqeury (npm)

The package jqeury was found to contain malicious code...

Malicious code in jqeury (npm)

The package jqeury was found to contain malicious code...

@baosight/xinrong (>=0.0.36, <=0.0.37), npm_1st_publish (1.0.0) +1 more potentially affected by unknown CVE via jqeury (0.0.1-security)

jqeury NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on jqeury and may be impacted: - @baosight/xinrong =0.0.36, =0.0.37 - npm1stpublish 1.0.0 - wypulldom 1.0.0 Source cves: unknown CVE Source advisory: GHSA-4964-CJRR-JG97...

PT-2020-21008

Name of the Vulnerable Software and Affected Versions jqeury version 3.3.1 Description The issue concerns a malicious package designed to exploit users who mistakenly install it due to a typo in the module name. Upon installation, the package downloads and executes a file from a remote server,...