WS-2019-0458

node-ftp v0.3.10 contains malicious code. The package uploads system information such as OS and hostname to a remote server...

CVE-2026-41324

basic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A malicious or compromised server can send an extremely large or never-ending listing response to...

Malicious code in node-ftp (npm)

The package node-ftp was found to contain malicious code...

MAL-2025-27624 Malicious code in node-ftp (npm)

The package node-ftp was found to contain malicious code...

nineone152 (>=1.1.9, <=1.1.11) potentially affected by unknown CVE via node-ftp (0.0.1-security)

node-ftp NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on node-ftp and may be impacted: - nineone152 =1.1.9, =1.1.11 Source cves: unknown CVE Source advisory: OSV:MAL-2025-27624...

Malicious Package in node-ftp

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. Recommendation Remove the package from your environment. There are no indications of further compromise...

nineone152 (>=1.1.9, <=1.1.11) potentially affected by unknown CVE via node-ftp (0.0.1-security)

node-ftp NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on node-ftp and may be impacted: - nineone152 =1.1.9, =1.1.11 Source cves: unknown CVE Source advisory: OSV:GHSA-5JGP-PG4F-Q8VJ...

GHSA-5JGP-PG4F-Q8VJ Malicious Package in node-ftp

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. Recommendation Remove the package from your environment. There are no indications of further compromise...

Malicious Package

node-ftp is a malicious package. When the package is installed or required, the package attempts to send hostname information to the attacker's server, affecting confidentiality of the victim's server which can potentially bridges to other attack vectors like remote code execution...