bomber

bomber is an application that scans SBOMs for security vulnerabilities. Overview So you've asked a vendor for an Software Bill of Materials SBOM for one of their closed source products, and they provided one to you in a JSON file... now what? The first thing you're going to want to do is see if a...

CVE-2025-29927

CVE-2025-29927 in Next.js 15.2.0 How to Run: git clone https://github.com/nyctophile0969/CVE-2025-29927 cd CVE-2025-29927 npm install [email protected] npm run dev...

CVE-2021-44906

CVE-2021-44906 Originally from: https://github.com/Marynk/JavaScript-vulnerability-detection/blob/main/minimist%20PoC.zip Run npm run hack And you will see the any function's done property is changed to true. The explanation of command line node index.js --.concat.constructor.prototype.done true:...

Netmask NPM Package - Server-Side Request Forgery

Netmask NPM Package is susceptible to server-side request forgery because of improper input validation of octal strings in netmask npm package. This allows unauthenticated remote attackers to perform indeterminate SSRF, remote file inclusion, and local file inclusion attacks on many of the...

npm ansi_up v4 - Cross-Site Scripting

npm package ansiup v4 is vulnerable to cross-site scripting because ANSI escape codes can be used to create HTML hyperlinks. id: CVE-2021-3377 info: name: npm ansiup v4 - Cross-Site Scripting author: geeknik severity: medium description: npm package ansiup v4 is vulnerable to cross-site scripting...

web_exploit_detector

Web Exploit Detector Introduction The Web Exploit Detector is a Node.js application and NPM module used to detect possible infections, malicious code and suspicious files in web hosting environments. This application is intended to be run on web servers hosting one or more websites. Running the...

PDFkit-CMD-Injection

PDFkit-CMD-Injection CVE-2022-25765 Detail Description The package pdfkit from 0.0.0 are vulnerable to Command Injection where the URL is not properly sanitized. PoC Start a HTTP server 1- python3 -m http.server 80 Start a netcat listener 2- nc -lnvp 'Target Port' Make a request 3-...

cve-2025-12735-expr-eval-rce

CVE-2025-12735 expr-eval RCE Exploit A security research tool for detecting and testing the CVE-2025-12735 vulnerability in the expr-eval and expr-eval-fork npm packages. ⚠️ Disclaimer This tool is for authorized security testing and educational purposes only. Unauthorized access to computer...

scavenger_scanner

CVE-2025-54313 IOC Scanner Cross-platform scanners for detecting Indicators of Compromise IOCs related to the eslint-config-prettier supply chain attack CVE-2025-54313. On July 18, 2025, several popular npm packages were compromised through a phishing attack. The attacker gained access to the...

aws-key-disabler

AWS Lambda - IAM Access Key Disabler The AWS Key disabler is a Lambda Function that disables AWS IAM User Access Keys after a set amount of time in order to reduce the risk associated with old access keys. AWS Lambda Architecture SysOps Output for EndUser Developer Toolchain Current Limitations A...

MAL-2026-18200 Malicious code in @seggy116/next-diff (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb5c18734e8db92923153cc8bbf81fe90bcb53d5fe9d17a7640014d51e165dbc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @seggy116/next-diff (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb5c18734e8db92923153cc8bbf81fe90bcb53d5fe9d17a7640014d51e165dbc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18199 Malicious code in @pkgship/frps-linux-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8e58ce3b050fea33c534b17cada105c9c7eef3b0daf59a904a1b31151035a727 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2021-21315-PoC

CVE-2021-21315-systeminformation This is Proof of Concept for CVE-2021-21315 which affects The System Information Library for Node.JS npm package "systeminformation". npmjs.com/systeminformation "be sure to check or sanitize service parameters that are passed to si.inetLatency, si.inetChecksite,...

MAL-2026-18198 Malicious code in @pkgship/frpc-linux-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99b326de85c188621a7204e38f8d68eea6969822d6012215c9f776fa70054568 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @pkgship/frpc-linux-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99b326de85c188621a7204e38f8d68eea6969822d6012215c9f776fa70054568 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kvarzo8f3atestmetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a85ccef88aba99ac71165f2b02e40f009e9ac8d25319da2abe5a712a1886ac47 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18202 Malicious code in sdk-utils-testmetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea4b599291b3a9c88aa74d76577283eca640df072aa340bf95558077c06527fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sdk-utils-testmetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea4b599291b3a9c88aa74d76577283eca640df072aa340bf95558077c06527fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-18201 Malicious code in kvarzo8f3atestmetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a85ccef88aba99ac71165f2b02e40f009e9ac8d25319da2abe5a712a1886ac47 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...