@amazeelabs/publisher (>=2.4.28, <=2.5.8), @angular-devkit/build-angular (>=18.0.0-next.3, <=19.0.0-next.9) +60 more potentially affected by CVE-2024-21536 via http-proxy-middleware (>=3.0.0, <=3.0.2)

http-proxy-middleware NPM version =3.0.0, =2.4.28, =18.0.0-next.3, =18.0.0-next.39, =18.0.0-next.39, =2.1.0-next.0, =2.1.0-next.0, =2.1.0-next.0, =2.1.0-next.0, =2.1.0-next.0, =8.10.0-nightly.20240906232837, =3.11.0-beta.6, =1.1.0, =0.0.26, =0.0.26, =8.0.0-canary.984, =9.0.0-canary.203 and more...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to an UnhandledPromiseRejection error thrown by micromatch. An attacker could kill the Node.js process and crash the server by making requests to certain paths. PoC 1 Run a server like this: js const express =...

PT-2024-18950

Content removed...

Malware in paysafe-gpf-as-http-proxy-middleware-body-replace

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2024-1164 Malicious code in paysafe-gpf-as-http-proxy-middleware-body-replace (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69515fe4abb4869b5999b249c8de31a55fd23bda38e3bd9de3c58c5c245bc5b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...