Malicious code in dotenv-parse-variables-xanthus-nestjs-playwright (npm)

The package dotenv-parse-variables-xanthus-nestjs-playwright was found to contain malicious code...

Malicious code in sirius-kuiperbelt-dendrochronology-nestjs (npm)

The package sirius-kuiperbelt-dendrochronology-nestjs was found to contain malicious code...

Malicious code in nestjs-betelgeuse-xml-polaris (npm)

The package nestjs-betelgeuse-xml-polaris was found to contain malicious code...

Malicious code in semantic-ui-nestjs-ionosphere-terser-webpack-plugin (npm)

The package semantic-ui-nestjs-ionosphere-terser-webpack-plugin was found to contain malicious code...

MAL-2025-27304 Malicious code in nestjs-celeste-proxima-antares (npm)

The package nestjs-celeste-proxima-antares was found to contain malicious code...

MAL-2025-19914 Malicious code in europa-zenith-deneb-nestjs (npm)

The package europa-zenith-deneb-nestjs was found to contain malicious code...

MAL-2025-24135 Malicious code in jwt-mongodb-nestjs-gacrux (npm)

The package jwt-mongodb-nestjs-gacrux was found to contain malicious code...

MAL-2025-32932 Malicious code in semantic-ui-nestjs-ionosphere-terser-webpack-plugin (npm)

The package semantic-ui-nestjs-ionosphere-terser-webpack-plugin was found to contain malicious code...

MAL-2025-27303 Malicious code in nestjs-betelgeuse-xml-polaris (npm)

The package nestjs-betelgeuse-xml-polaris was found to contain malicious code...

MAL-2025-27305 Malicious code in nestjs-uranology-virgo-proxima (npm)

The package nestjs-uranology-virgo-proxima was found to contain malicious code...

MAL-2025-6817 Malicious code in nestjs-datadog (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bd646630e4e4b32350e3698792f7e678a5be4aa1167c630d0bef9cb4d491c441 The OpenSSF Package Analysis project identified 'nestjs-datadog' @ 500.0.2 npm as malicious. It is considered malicious because: - The package...

Malicious code in nestjs-datadog (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bd646630e4e4b32350e3698792f7e678a5be4aa1167c630d0bef9cb4d491c441 The OpenSSF Package Analysis project identified 'nestjs-datadog' @ 500.0.2 npm as malicious. It is considered malicious because: - The package...

CVE-2025-54782

Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution RCE vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API...

@ballerine/workflows-service (>=0.4.6, <=0.5.49), @digitaltg/vc-signer (1.0.0) +9 more potentially affected by CVE-2025-54782 via @nestjs/devtools-integration (0.1.6)

@nestjs/devtools-integration NPM version 0.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on @nestjs/devtools-integration and may be impacted: - @ballerine/workflows-service =0.4.6, =0.0.37, =0.0.4, =0.0.1, =0.0.6, =0.0.82, =0.0.32, =1.0.0, =1.0.9 -...

Arbitrary Command Injection

Overview @nestjs/devtools-integration is a Nest - modern, fast, powerful node.js web framework @devtools-integration Affected versions of this package are vulnerable to Arbitrary Command Injection via the inspector/graph/interact endpoint, which accepts JSON input containing a code field and...

CVE-2025-54782

Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution RCE vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API...

nest 命令注入漏洞

nest is a Node.js framework open-sourced by nestjs for building efficient, scalable and enterprise-class server-side applications using TypeScript/JavaScript. A command injection vulnerability exists in nest 0.2.0 and earlier versions, which stems from the presence of an insecure JavaScript sandb...

CVE-2025-54782 @nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers

Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution RCE vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API...

CVE-2025-54782

CVE-2025-54782 affects the NestJS devtools-integration package (versions 0.2.0 and earlier). The vulnerability enables Remote Code Execution via a local development HTTP server endpoint, /inspector/graph/interact, which accepts JSON containing a code field and executes it in a Node.js vm.runInNew...

CVE-2025-54782 @nestjs/devtools-integration's CSRF to Sandbox Escape Allows for RCE against JS Developers

Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution RCE vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API...