Malicious Package

Overview stripe-identity-react-native is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if...

Malicious Package

Overview @uc-maps/provider-google.react is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if...

Malicious code in react_popper_old (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e281af61adcbe405037f7cac58495892a35fb0370322dbe5db6b15825d8ce18 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

tauri-async-handler (>=0.1.0 <=0.4.0), tauri-react (=0.1.0) potentially affected by CVE-2022-39215 via tauri (>=0.10.0 <=0.9.2)

tauri CARGO version =0.10.0, =0.1.0, =0.4.0 - tauri-react =0.1.0 Source cves: CVE-2022-39215 Source advisory: OSV:RUSTSEC-2022-0088...

Malicious Package

Overview react-server-dom-vite is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Prototype Pollution

react-navigation is vulnerable to prototype pollution. A malicious input can be parsed and decoded as it does not prevent the properties such as "proto" to pollute the global object prototype...

@alloyify/anvil (>=1.1.2 <=1.1.4), @alloyify/devkit (>=1.1.2 <=1.1.4) +12 more potentially affected by CVE-2022-25907 via ts-deepmerge (=2.0.1)

ts-deepmerge NPM version =2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on ts-deepmerge and may be impacted: - @alloyify/anvil =1.1.2, =1.1.2, =1.1.2, =1.1.2, =0.0.0-canary-20220330074435, =0.0.0-canary-20220330074435, =5.0.24, =11.1.27, =4.0.22,...

Malicious code in fk-react-lottie-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 33691a695b98097014a383d3aaf0e290cf4b6c6793c824ab4324aebe7ea66e3c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pidl-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c44ef20dff714fe4e975abeb339f64d0becb0baca615a0c0b9b8eb14fe35d418 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5331 Malicious code in pidl-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c44ef20dff714fe4e975abeb339f64d0becb0baca615a0c0b9b8eb14fe35d418 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zohocomponents-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02306ea3563fd27b7738a5f7bbdf6a9f47659e2c1304067934fe7b49e0975410 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7410 Malicious code in zohocomponents-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02306ea3563fd27b7738a5f7bbdf6a9f47659e2c1304067934fe7b49e0975410 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in yahoo-react-popup-select (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e505b7871307d7dfdf3bef0c52da5103e1b0e20b4fa2c34749183d4e29a55be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7313 Malicious code in yahoo-react-popup-select (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e505b7871307d7dfdf3bef0c52da5103e1b0e20b4fa2c34749183d4e29a55be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in suspicious-react-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b72ddb83c9fbe20fe07636b0a5aedb1c5f788d74050f6027f090bce10b2ab48b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6367 Malicious code in suspicious-react-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b72ddb83c9fbe20fe07636b0a5aedb1c5f788d74050f6027f090bce10b2ab48b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @contasimples/simples-react-ui is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if...

@toggled-apps/react-native-collapsible-scroll (>=1.0.0 <=1.0.2), @toggled-apps/react-native-product-carousel (=1.0.3) +9 more potentially affected by CVE-2022-24373 via react-native-reanimated (>=2.0.0-rc.0 <=2.0.1)

react-native-reanimated NPM version =2.0.0-rc.0, =1.0.0, =1.0.0, =41.0.0, =41.0.0, =1.0.0, =1.1.0, =1.1.2 - ui-ux =0.0.1 Source cves: CVE-2022-24373 Source advisory: SNYK:JS-REACTNATIVEREANIMATED-2949507...

Regular Expression Denial of Service (ReDoS)

Overview react-native-reanimated is a More powerful alternative to Animated library for React Native. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS due to improper usage of regular expression in the parser of Colors.js. PoC js new...

MAL-2022-5632 Malicious code in react-bank-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff5553f821ba524b88f457343bcddbb43c844774492bf8fdb955996520d7b417 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...