Regular Expression Denial of Service (ReDoS)

Overview react-native-reanimated is a More powerful alternative to Animated library for React Native. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS due to improper usage of regular expression in the parser of Colors.js. PoC js new...

MAL-2022-5632 Malicious code in react-bank-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff5553f821ba524b88f457343bcddbb43c844774492bf8fdb955996520d7b417 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-bank-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff5553f821ba524b88f457343bcddbb43c844774492bf8fdb955996520d7b417 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in react-bank-api

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview react-bank-api is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package wa...

react-native-url-preview (1.1.9), react-native-url-preview-tgp (1.1.9) +1 more potentially affected by CVE-2022-25876 via link-preview-js (>=2.0.4, <=2.1.13)

link-preview-js NPM version =2.0.4, =2.1.4, =2.2.0 Source cves: CVE-2022-25876 Source advisory: GHSA-H9CW-7G8J-H66H...

react-native-url-preview (1.1.9), react-native-url-preview-tgp (1.1.9) +1 more potentially affected by CVE-2022-25876 via link-preview-js (>=2.0.4, <=2.1.13)

link-preview-js NPM version =2.0.4, =2.1.4, =2.2.0 Source cves: CVE-2022-25876 Source advisory: OSV:GHSA-H9CW-7G8J-H66H...

react-native-url-preview (>=1.1.1, <=1.1.9), react-native-url-preview-tgp (1.1.9) +1 more potentially affected by CVE-2022-25876 via link-preview-js (>=1.6.0, <=2.1.13)

link-preview-js NPM version =1.6.0, =1.1.1, =2.1.4, =2.2.0 Source cves: CVE-2022-25876 Source advisory: MEND:CVE-2022-25876...

CVE-2022-31103

lettersanitizer is a DOM-based HTML email sanitizer for in-browser email rendering. All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule @keyframes. This package is depended on by react-letter, therefore everyone using react-letter is...

Denial of service

lettersanitizer is a DOM-based HTML email sanitizer for in-browser email rendering. All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule @keyframes. This package is depended on by react-letter, therefore everyone using react-letter is...

CVE-2022-31103 Improper handling of CSS at-rules in lettersanitizer

lettersanitizer is a DOM-based HTML email sanitizer for in-browser email rendering. All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule @keyframes. This package is depended on by react-letter, therefore everyone using react-letter is...

CVE-2022-31103 Improper handling of CSS at-rules in lettersanitizer

lettersanitizer is a DOM-based HTML email sanitizer for in-browser email rendering. All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule @keyframes. This package is depended on by react-letter, therefore everyone using react-letter is...

CVE-2022-31103 Improper handling of CSS at-rules in lettersanitizer

lettersanitizer is a DOM-based HTML email sanitizer for in-browser email rendering. All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule @keyframes. This package is depended on by react-letter, therefore everyone using react-letter is...

CVE-2022-31103: Improper Check for Unusual or Exceptional Conditions

lettersanitizer is a DOM-based HTML email sanitizer for in-browser email rendering. All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule @keyframes. This package is depended on by react-letter, therefore everyone using react-letter is...

Improper handling of CSS at-rules in lettersanitizer

Impact All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule @keyframes. This package is depended on by react-letter, therefore everyone using react-letter is also at risk. Patches The problem has been patched in version 1.0.2...

GHSA-7R3R-GQ8P-V9JJ Improper handling of CSS at-rules in lettersanitizer

Impact All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule @keyframes. This package is depended on by react-letter, therefore everyone using react-letter is also at risk. Patches The problem has been patched in version 1.0.2...

Malicious Package

Overview starter-react-frontend-app is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if thi...

Malicious Package

Overview react-jesting-library is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious Package

Overview react-datepicker-docs is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious Package

Overview react-ldclient-default-values is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if...