123047 matches found
WS-2020-0190
twilio-npm opened a reverse shell to a remote server as a postinstall script. Remediation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The packa...
Nexus-Sonatype-Repository-Manager-Groovy-Script-RCE-Authenticated-
Nexus Repository Manager 3 Authenticated RCE Groovy Script Ta...
WS-2020-0176
Upon installation, the 'electorn' package runs a preinstall script that writes a public comment on GitHub containing the following information: IP, IP-based geolocation, home directory name and local username...
WS-2020-0175
Upon installation, the 'loadyaml' package runs a preinstall script that writes a public comment on GitHub containing the following information: IP, IP-based geolocation, home directory name and local username...
WS-2019-0488
Yeoman-genrator v1.0.0 contains malicious code as a preinstall script. The package is malware designed to take advantage of user's mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor...
WS-2019-0482
All versions of uglyfi.js contains malicious code as a preinstall script. The package designed to take advantage of user's mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor...
WS-2019-0481
All versions of test-module-a contain malicious code as a preinstall script. The package fetches all names of npm packages owned by the user and attempts to add another maintainer to every package as a means of package hijacking...
WS-2019-0461
versions v1.0.0--v1.0.4 of only-test-not-install contain malicious code. The package deletes the folder /test from the system as a postinstall script...
WS-2019-0454
All versions of my-very-own-package contain malicious code. The package sends the output of process.versions, process.arch and process.platform to a remote server in a postinstall script...
WS-2019-0448
maybemaliciouspackage v1.0.0-v1.0.1 contain malicious code. The package prints the system's SSH keys to the console as a postinstall script...
WS-2019-0444
Version 1.0.0 of logsymbles contains malicious code as a preinstall script. The package is malware that when installed, downloads a file from a remote server, executes it and opens a backdoor...
WS-2019-0443
Version 1.0.0 of log-symboles contains malicious code as a preinstall script. The package is malware that when installed, downloads a file from a remote server, executes it and opens a backdoor...
WS-2019-0441
kraken-api v0.1.8 contains malicious code as a postinstall script. When installed, the package calls home to a Command and Control server to execute arbitrary commands...
WS-2019-0436
All versions of jquerz contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor...
WS-2019-0433
Harmlesspackage version 0.0.1 contains malicious code as a postinstall script. The package printed a message to the console and performed a GET request to a remote server...
WS-2019-0429
All versions of froever contain malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opened a backdoor...
CVE-2026-6174 CC Child Pages <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more' Parameter
The CC Child Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'more' parameter in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access a...
WS-2020-0061
All versions of m-backdoor contain malicious code. The package downloads a file from a remote server and executes it as a preinstall script. At the time of the release of this advisory the downloaded file only defaces websites by removing elements randomly from the DOM...