WS-2020-0202

The package jdb.js contained malicious code. The package ran a postinstall script and contained a dropper for the njRAT/Bladabindi Remote Access Trojan...

WS-2020-0190

twilio-npm opened a reverse shell to a remote server as a postinstall script. Remediation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The packa...

Nexus-Sonatype-Repository-Manager-Groovy-Script-RCE-Authenticated-

Nexus Repository Manager 3 Authenticated RCE Groovy Script Ta...

WS-2020-0176

Upon installation, the 'electorn' package runs a preinstall script that writes a public comment on GitHub containing the following information: IP, IP-based geolocation, home directory name and local username...

WS-2020-0175

Upon installation, the 'loadyaml' package runs a preinstall script that writes a public comment on GitHub containing the following information: IP, IP-based geolocation, home directory name and local username...

WS-2019-0488

Yeoman-genrator v1.0.0 contains malicious code as a preinstall script. The package is malware designed to take advantage of user's mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor...

WS-2019-0482

All versions of uglyfi.js contains malicious code as a preinstall script. The package designed to take advantage of user's mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor...

WS-2019-0481

All versions of test-module-a contain malicious code as a preinstall script. The package fetches all names of npm packages owned by the user and attempts to add another maintainer to every package as a means of package hijacking...

WS-2019-0461

versions v1.0.0--v1.0.4 of only-test-not-install contain malicious code. The package deletes the folder /test from the system as a postinstall script...

WS-2019-0454

All versions of my-very-own-package contain malicious code. The package sends the output of process.versions, process.arch and process.platform to a remote server in a postinstall script...

WS-2019-0448

maybemaliciouspackage v1.0.0-v1.0.1 contain malicious code. The package prints the system's SSH keys to the console as a postinstall script...

WS-2019-0444

Version 1.0.0 of logsymbles contains malicious code as a preinstall script. The package is malware that when installed, downloads a file from a remote server, executes it and opens a backdoor...

WS-2019-0443

Version 1.0.0 of log-symboles contains malicious code as a preinstall script. The package is malware that when installed, downloads a file from a remote server, executes it and opens a backdoor...

WS-2019-0441

kraken-api v0.1.8 contains malicious code as a postinstall script. When installed, the package calls home to a Command and Control server to execute arbitrary commands...

WS-2019-0436

All versions of jquerz contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor...

WS-2019-0433

Harmlesspackage version 0.0.1 contains malicious code as a postinstall script. The package printed a message to the console and performed a GET request to a remote server...

WS-2019-0429

All versions of froever contain malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opened a backdoor...

CVE-2026-6174 CC Child Pages <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more' Parameter

The CC Child Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'more' parameter in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access a...

WS-2020-0061

All versions of m-backdoor contain malicious code. The package downloads a file from a remote server and executes it as a preinstall script. At the time of the release of this advisory the downloaded file only defaces websites by removing elements randomly from the DOM...

WS-2019-0417

Donotinstallthis malicious package contains a script that runs as part of the install script. The script contacts a remote service that tracks how many installations were done...