Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal where an attacker can traverse the file system and access files outside of the intended directory. PoC 1 Install the files-bucket-server package: npm install files-bucket-server 2 Create a new directory: mkdir...

MAL-2025-2573 Malicious code in keypair-encryption (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1265d869c665e7bb42b4827bc9f51ad572b2ce181edebfc84eeb5698e0e39048 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in shanye-ethereumjs-utill (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f814c33a73ebb5b7666c8992f190fa3bc72c80a9580f40c2d73fed35b14e0348 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tokesjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77cf2bffbafed158e996b9fb6581994a5dda5f00137197ee10e3538b2e68eeb9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2491 Malicious code in @theoretical123/providers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e1ac0be55c85d10a80061be96a98fee35155a4a24297d95b281f4ce8226b42a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gash (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0d7e92080b720d7d708537639734002025adb32846e183163eab64fed19c17e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in key-lister (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6f9c33eb066fce6253ba86498debbec8fe000ace68796a6bddf5d95e431551b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2372 Malicious code in dev-debugger-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 836268a49761be0bbcd6dd89283cbaceea33d8ddf28b8fec0ca5337c318eba52 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vue-plugin-rely1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41339a779b006586f47ed496d71acbb4b97bf4174fdd98bf7aced85ed56e6c4d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secureshield1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2c523ad578efae0d36959b764d0ea4df3c7c88342580a6b3903a2873af85619e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nicegirl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05d61fc6a090b764666270f91b100bc166fbb85c0227ac947e1bdc876bc8e6a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in paymentread-paypal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99ea0fd7ce8df578106ddafd97e7ce60c03a1b0c1481c5a1caa636edd634246b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2310 Malicious code in event-handle-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 07ebcac63455f7e71c3494f3d9dcff8de8fcc17290bff93372dd297555198012 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in yoojae-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc98fbe305ce2dc7d6ada4fca1d13920ebb82e43a8cf91af458cd37c509ed466 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sniper-hashing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 50c012e4494af56a19f93746e9ed8953360220771f69cc28023e8b8bb3445e69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in core-registry-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84d80a92f4bc9e749a6e972e2ce5a00a5861906ac964b41440b6bc71194dbb65 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cpp-spa-loginad (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2071430481129f44784f3feac01baf6baa6ab03ebf6855bd2231bc91594038d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ai-verify-shared-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f88a03bc9be981617ba8a71b55e2c7051d9cdf7397638bc7ec35ad84c17c455b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ember-js-buy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a24179f2ae6d315fef8213c658f3e09ac85864b27355682956318b77f10e22a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in simple-export-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d44defb42445d3a7511f32616401e72a003e6eee8f3e47cd2ca1f41b4026f65b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...