EUVD-2025-123939

Malicious code in passport-io-gatsby-nconf npm...

EUVD-2025-124598

Malicious code in nconf-nodemon-start-postcss npm...

EUVD-2025-111135

Malicious code in mini-css-extract-plugin-meteor-capella-nconf npm...

EUVD-2025-124875

Malicious code in miranda-nconf-package-puppeteer npm...

EUVD-2025-124594

Malicious code in nconf-procyon-postcss-ora npm...

EUVD-2025-115594

Malicious code in celeste-markdown-event-nconf npm...

MAL-2025-145323 Malicious code in nconf-pm2-betelgeuse-hugo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 579c08e42060107bc857e3612f24ebab9512e18086d759797eb7b738dd5ee1a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in miranda-nconf-package-puppeteer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4861844fae84d7b05a5030f56b0acc16628a4c8ba3f5d874c50d0f49d20539dd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-112775

Malicious code in hexo-changelog-sagitta-nconf npm...

EUVD-2025-124601

Malicious code in nconf-hercules-prettier-stylelint-slides npm...

EUVD-2025-115467

Malicious code in chalk-gemini-nconf-cz-conventional-changelog npm...

MAL-2025-145043 Malicious code in miranda-nconf-package-puppeteer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4861844fae84d7b05a5030f56b0acc16628a4c8ba3f5d874c50d0f49d20539dd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2022-1659

Malicious code in bioql PyPI...

CVE-2022-21803 Prototype Pollution

This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted...

CVE-2022-21803

This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted...