30 matches found
@htyf-mp/cli (>=0.6.0, <=0.7.6), @htyf-mp/taro-plugin-platform (>=0.6.0, <=0.7.5) +1 more potentially affected by CVE-2026-97724 via react-native-worklets (0.12.1)
react-native-worklets NPM version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on react-native-worklets and may be impacted: - @htyf-mp/cli =0.6.0, =0.6.0, =0.1.5, =0.1.11 Source cves: CVE-2026-97724 Source advisory: MEND:CVE-2026-97724...
Malicious Package
Overview @spcsn/taro-cli is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2026-4409 Malicious code in @nutui/nutui-react-taro (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71ad42f4bfd953311c2d69f622cc6e8d5193a8852ac0bbc9ea0781ac6b651390 The package's postinstall.js invokes execSync'npm-usage-stats disable' and execSync'npm-usage-stats', stdio: 'inherit' . The npm-usage-stats bin is...
MAL-2026-4447 Malicious code in @spcsn/taro-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10e2baba3a5166ecf1196146e1b2a8771836b25bd7f8d56979e3e277a3de9625 The package's postinstall script probes https://taro.jd.com/ and then invokes its own CLI to run npm install...
Malicious code in @spcsn/taro-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10e2baba3a5166ecf1196146e1b2a8771836b25bd7f8d56979e3e277a3de9625 The package's postinstall script probes https://taro.jd.com/ and then invokes its own CLI to run npm install...
Malicious code in @tarojs/cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59b4e6cd0fe6bd16c6fb2bd04e6542a2a3052182d8815a08b124df56f2d9fde2 On npm install, the package's postinstall script performs a reachability GET to https://taro.jd.com/ and, on success, invokes the package's own...
EUVD-2021-1970
Malware in sbrugna...
ruoyi-vue-pro Authorization Issue Vulnerability
ruoyi-vue-pro is China's taro source code zhijiantianya open source an optimized refactoring of efficient backend management system framework for the development of enterprise backend , SaaS platforms , WeChat small program backend and so on. ruoyi-vue-pro 2025.09 and previous versions of the...
@tarojs/rn-runner (>=4.0.0-alpha.0, <=4.1.2-alpha.2), @tarojs/rn-style-transformer (>=4.0.0-alpha.0, <=4.1.2-alpha.2) +2 more potentially affected by CVE-2025-5896 via taro-css-to-react-native (>=4.0.0-alpha.0, <=4.1.2-alpha.2)
taro-css-to-react-native NPM version =4.0.0-alpha.0, =4.0.0-alpha.0, =4.0.0-alpha.0, =4.0.0-alpha.0, =4.0.0-alpha.0, =4.1.2-alpha.2 Source cves: CVE-2025-5896 Source advisory: GHSA-F5XG-CFPJ-2MW6...
@tarojs/rn-runner (>=4.0.0-alpha.0, <=4.1.2-alpha.2), @tarojs/rn-style-transformer (>=4.0.0-alpha.0, <=4.1.2-alpha.2) +2 more potentially affected by CVE-2025-5896 via taro-css-to-react-native (>=4.0.0-alpha.0, <=4.1.2-alpha.2)
taro-css-to-react-native NPM version =4.0.0-alpha.0, =4.0.0-alpha.0, =4.0.0-alpha.0, =4.0.0-alpha.0, =4.0.0-alpha.0, =4.1.2-alpha.2 Source cves: CVE-2025-5896 Source advisory: OSV:GHSA-F5XG-CFPJ-2MW6...
GHSA-F5XG-CFPJ-2MW6 taro-css-to-react-native Regular Expression Denial of Service vulnerability
A vulnerability was found in tarojs taro up to 4.1.1. It has been declared as problematic. This vulnerability affects unknown code of the file taro/packages/css-to-react-native/src/index.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely...
CVE-2025-5896
A vulnerability was found in tarojs taro up to 4.1.1. It has been declared as problematic. This vulnerability affects unknown code of the file taro/packages/css-to-react-native/src/index.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely...
CVE-2025-5896 tarojs taro index.js redos
A vulnerability was found in tarojs taro up to 4.1.1. It has been declared as problematic. This vulnerability affects unknown code of the file taro/packages/css-to-react-native/src/index.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely...
@agreejs/cli (>=0.0.1, <=3.2.43), @agreejs/rn-runner (>=3.2.1, <=3.2.15) +98 more potentially affected by CVE-2025-5896 via taro-css-to-react-native (>=1.3.0-beta.1, <=4.1.2-alpha.2)
taro-css-to-react-native NPM version =1.3.0-beta.1, =0.0.1, =3.2.1, =3.2.1, =1.0.0, =1.0.0, =1.0.0-alpha.1, =1.0.0-alpha.1, =1.0.0, =1.1.5, =1.0.0, =1.3.2 - @c-art/convert-cli 1.1.0 - @d-bigfish/cli 1.0.14 - @d1m-atom/taro-vue-cli 1.0.5 and more Source cves: CVE-2025-5896 Source advisory:...
CVE-2025-5896
A vulnerability was found in tarojs taro up to 4.1.1. It has been declared as problematic. This vulnerability affects unknown code of the file taro/packages/css-to-react-native/src/index.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely...
NervJS taro 安全漏洞
NervJS taro is an open cross-end cross-framework solution open-sourced by NervJS. A security vulnerability exists in NervJS taro version 4.1.1 and earlier, which stems from an incorrect manipulation of the file taro/packages/css-to-react-native/src/index.js resulting in inefficient regular...
CVE-2025-5896: Inefficient Regular Expression Complexity
A vulnerability was found in tarojs taro up to 4.1.1. It has been declared as problematic. This vulnerability affects unknown code of the file taro/packages/css-to-react-native/src/index.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely...
CVE-2021-3804
taro is vulnerable to Inefficient Regular Expression Complexity...
