Malicious code in lexical-monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4af686331feed45b8818ceff08372677fb1f0f5531b48057d994aa8d3e871fc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5389 Malicious code in pocjenkircetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ebbf04e7a39de82685b8e0cb1fc6ad03deb085f0db3630624a3b736b99d0a7f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in titles (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware abd4ff58249068e7da5354d6c1c536d8d1c88de26e977798b1965f29fb3d91bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6122 Malicious code in simple-project-pkg-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36656e6b75ae254df7a6e2a5d6664fe017a1357d328c429930e852e963f4dca3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5069 Malicious code in oms-js-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f979ac49e09f1b3b30af6ae6dbf7c93f84fa24836cfcee4df4f677a1522dde6c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7415 Malicious code in zuanshi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b63254b223cbeaba40946dd0cc604245529ff5b147026f6c49ec973877507c33 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Code injection

This affects all versions of package @cookiex/deep. The global proto object can be polluted using the proto object...

GHSA-H232-FPQX-MQGR Malicious Package in log-symboles

Version 2.1.0 of log-symboles contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoo...

GHSA-WHJR-JJ69-7PRM Malicious Package in import-mysql

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. Recommendation Remove the package from your environment. There are no indications of further compromise...

Malicious Package in rrequest

All versions of rrequest typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process...

Malicious Package in chak

All versions of chak typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was...

CVE-2020-5282 arbitrary shell execution in Nick Chan Bot

In Nick Chan Bot before version 1.0.0-beta there is a vulnerability in the npm command which is part of this software package. This allows arbitrary shell execution,which can compromise the bot This is patched in version 1.0.0-beta...

Malicious Package

Overview All versions of requst typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the...