hijagger

hijagger - ハイジャック可能なパッケージをパッケージレジストリからチェックする このツールは、NPM および Python Pypi レジストリ内のすべてのパッケージのすべてのメンテナーについて、未登録のドメインまたはそれらのドメイン上の未登録の MX レコードをチェックします。ドメインが未登録の場合、そのドメインを取得し、2 要素認証が有効になっていなければアカウントのパスワードリセットを開始できます。これにより、パッケージをハイジャックして、そのパッケージに対して任意の操作を行うことができます。...

GHSA-74JP-VM22-8Q8X vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

@0xwork/connect (>=0.1.0, <=0.1.7), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +24 more potentially affected by CVE-2026-53808 via openclaw (>=2026.3.22, <=2026.5.2)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2026.3.25, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.1.0, =0.1.1, =0.2.18 and more Source cves: CVE-2026-53808 Source advisory: OSV:GHSA-CQWV-9QJX-VXW2...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

@agentholdings/agent-passport (>=0.1.0, <=0.1.5), @chrysb/alphaclaw (0.8.3-beta.1) +11 more potentially affected by CVE-2026-33576 via openclaw (>=2026.3.22, <=2026.3.24-beta.2)

openclaw NPM version =2026.3.22, =0.1.0, =2026.3.25, =2026.3.24-3, =0.14.39, =0.1.1, =2.0.1, =0.0.7, =0.14.6, =0.1.0, =0.1.5 Source cves: CVE-2026-33576 Source advisory: OSV:GHSA-V2V2-F783-358J...

@regis-samurai/n8n (>=0.216.1, <=0.219.1), n8n-nodes-accelo (>=0.1.0, <=0.1.9) +8 more potentially affected by CVE-2025-65964 via n8n (>=0.138.0, <=0.219.1)

n8n NPM version =0.138.0, =0.216.1, =0.1.0, =0.18.0, =0.1.0, =0.1.0, =0.2.14, =0.1.0, =0.1.0, =0.1.7 Source cves: CVE-2025-65964 Source advisory: OSV:GHSA-WPQC-H9WP-CHMQ...

EUVD-2017-17854

Malware in sbrugna...

Malicious Package in test-module-a

All versions of test-module-a contain malicious code as a preinstall script. The package fetches all names of npm packages owned by the user and attempts to add another maintainer to every package as a means of package hijacking, Recommendation Remove the package from your system. If you own any...

GHSA-76XQ-58HJ-VWM2 Malicious Package in test-module-a

All versions of test-module-a contain malicious code as a preinstall script. The package fetches all names of npm packages owned by the user and attempts to add another maintainer to every package as a means of package hijacking, Recommendation Remove the package from your system. If you own any...

GHSA-QV78-398W-CXP7 Malicious Package in shrugging-logging

All versions of shrugging-logging contain malicious code as a postinstall script. The package fetches all names of npm packages owned by the user and attempts to add another maintainer to every package as a means of package hijacking, Recommendation Remove the package from your system. If you own...

Malicious Package in shrugging-logging

All versions of shrugging-logging contain malicious code as a postinstall script. The package fetches all names of npm packages owned by the user and attempts to add another maintainer to every package as a means of package hijacking, Recommendation Remove the package from your system. If you own...

Malicious Package

Overview All versions of test-module-a contain malicious code as a preinstall script. The package fetches all names of npm packages owned by the user and attempts to add another maintainer to every package as a means of package hijacking, Recommendation Remove the package from your system. If you...

Malicious Package

shrugging-logging is a malicious package. It contains malicious codes in postinstall script that fetches all names of npm packages owned by the user and attempts to add another maintainer to every package as a means of package hijacking...

Malicious Package

Overview All versions of shrugging-logging contain malicious code as a postinstall script. The package fetches all names of npm packages owned by the user and attempts to add another maintainer to every package as a means of package hijacking, Recommendation Remove the package from your system. I...

CVE-2017-8914

CVE-2017-8914 affects SAP HANA XS Sinopia (HDB 1.00 and 2.00). The root cause is an insecure default user-creation policy in Sinopia, enabling remote attackers to hijack npm packages or host arbitrary files. Public disclosures reference ERPScan and SAP Security Note 2407694; the advisory describe...

CVE-2017-8914: Undefined Security Weakness

sinopia, as used in SAP HANA XS 1.00 and 2.00, allows remote attackers to hijack npm packages or host arbitrary files by leveraging an insecure user creation policy, aka SAP Security Note 2407694...