Malware in react-nati0e-vecor-icons

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in react-addons-csgtransition-group (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 91dd68f9a036ce8b4eaafd804e42bffb33a88e09c44772a5314f7203c9f8ddda Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-cionx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e3e3849090250a1ee74742b012e19a14658dc8aec1ca7aa1cc0353cd6c48eb90 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-erro-roevrlay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c73f6967c5add4d8ba288d24e7f5dca715c764fa83db8368704512bcde3f33aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in eslint-plugin-reatc

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2022-1413 Malicious code in babel-preset-reatc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0969848ef493fcc6aa961ac138255ef7f702d4035b373a2961cdd56cd6118b30 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in babel-preset-reatc

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2022-5685 Malicious code in reactaddonscsstransitiong5rop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 03d7beac15790fc32919e89f105f8e97dcebb29e228dae55f576ab5b0cb153b8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ractnative (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13712f2e5e0e0ef3e2f23f220a2abbdd495085a6b3091e14510129580b3aacff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in babelpugintransformreactjsx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c5382dcc5be3a730f882330e09a06e62a180f32a8cb289d9f1dcd438ca6e2d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1435 Malicious code in babelpugintransformreactjsx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3c5382dcc5be3a730f882330e09a06e62a180f32a8cb289d9f1dcd438ca6e2d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in babelplugintransfomreactremoveproptypes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 118d5e800455cde3fd9da5c424f41242c449f5bdb4665b9f989cffe0d63e215c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Remote Code Execution

react-editable-json-tree is vulnerable to remote code execution.The vulnerability exists in onSubmitValueParser prop which calls parse function in src/utils/parse.js because of missing sanitization of the parse parameters which allows a remote attacker to inject and execute malicious code into th...

CVE-2022-36010 Arbitrary code execution via function parsing in react-editable-json-tree

This library allows strings to be parsed as functions and stored as a specialized component, JsonFunctionValue. To do this, Javascript's eval function is used to execute strings that begin with "function" as Javascript. This unfortunately could allow arbitrary code to be executed if it exists as ...

CVE-2022-36010 Arbitrary code execution via function parsing in react-editable-json-tree

This library allows strings to be parsed as functions and stored as a specialized component, JsonFunctionValue. To do this, Javascript's eval function is used to execute strings that begin with "function" as Javascript. This unfortunately could allow arbitrary code to be executed if it exists as ...

CVE-2022-36010

This library allows strings to be parsed as functions and stored as a specialized component, ""JsonFunctionValue"" https://github.com/oxyno-zeta/react-editable-json-tree/blob/09a0ca97835b0834ad054563e2fddc6f22bc5d8c/src/components/JsonFunctionValue.js. To do this, Javascript's ""eval""...

PT-2022-23110 · Unknown · React-Editable-Json-Tree

Name of the Vulnerable Software and Affected Versions: react-editable-json-tree versions =3.0.0, no...

CVE-2022-36010: Improper Neutralization of Directives in Dynamically Evaluated Code

This library allows strings to be parsed as functions and stored as a specialized component, JsonFunctionValue. To do this, Javascript's eval function is used to execute strings that begin with "function" as Javascript. This unfortunately could allow arbitrary code to be executed if it exists as ...

React Editable Json Tree security vulnerability

React Editable Json Tree is a library by the individual developer Havrileck Alexandre. A security vulnerability exists in React Editable Json Tree versions prior to 2.2.2, which stems from the ability to parse and execute arbitrary code via the eval function...

Malicious Package

Overview @uc-maps/provider-google.react is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if...