MAL-2025-6829 Malicious code in tensorflowjs (npm)

Package is malicious due to code obfuscation, arbitrary command execution via childprocess.spawn, and suspicious postinstall script. --- -= Per source details. Do not edit below this line.=-...

Malicious code in tensorflowjs (npm)

Package is malicious due to code obfuscation, arbitrary command execution via childprocess.spawn, and suspicious postinstall script. --- -= Per source details. Do not edit below this line.=-...

tensorflowjs (>=1.5.2 <=1.7.4) potentially affected by CVE-2020-26270 via tensorflow-cpu (=2.1.0)

tensorflow-cpu PYPI version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - tensorflowjs =1.5.2, =1.7.4 Source cves: CVE-2020-26270 Source advisory: OSV:PYSEC-2020-301...

tensorflowjs (>=1.5.2 <=1.7.4) potentially affected by CVE-2020-26266 via tensorflow-cpu (=2.1.0)

tensorflow-cpu PYPI version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - tensorflowjs =1.5.2, =1.7.4 Source cves: CVE-2020-26266 Source advisory: OSV:PYSEC-2020-297...

tensorflowjs (>=1.5.2 <=1.7.4) potentially affected by CVE-2020-26267 via tensorflow-cpu (=2.1.0)

tensorflow-cpu PYPI version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - tensorflowjs =1.5.2, =1.7.4 Source cves: CVE-2020-26267 Source advisory: OSV:PYSEC-2020-298...

tensorflowjs (>=1.5.2 <=1.7.4) potentially affected by CVE-2020-26268 via tensorflow-cpu (=2.1.0)

tensorflow-cpu PYPI version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - tensorflowjs =1.5.2, =1.7.4 Source cves: CVE-2020-26268 Source advisory: OSV:PYSEC-2020-299...

tensorflowjs (>=1.5.2 <=1.7.4) potentially affected by CVE-2020-26271 via tensorflow-cpu (=2.1.0)

tensorflow-cpu PYPI version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - tensorflowjs =1.5.2, =1.7.4 Source cves: CVE-2020-26271 Source advisory: OSV:GHSA-Q263-FVXM-M5MW...

tensorflowjs (>=1.5.2 <=1.7.4) potentially affected by CVE-2020-26270 via tensorflow-cpu (=2.1.0)

tensorflow-cpu PYPI version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - tensorflowjs =1.5.2, =1.7.4 Source cves: CVE-2020-26270 Source advisory: OSV:GHSA-M648-33QF-V3GP...

tensorflowjs (>=1.5.2 <=1.7.4) potentially affected by CVE-2020-26267 via tensorflow-cpu (=2.1.0)

tensorflow-cpu PYPI version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - tensorflowjs =1.5.2, =1.7.4 Source cves: CVE-2020-26267 Source advisory: OSV:GHSA-C9F3-9WFR-WGH7...

tensorflowjs (>=1.5.2 <=1.7.4) potentially affected by CVE-2020-26266 via tensorflow-cpu (=2.1.0)

tensorflow-cpu PYPI version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - tensorflowjs =1.5.2, =1.7.4 Source cves: CVE-2020-26266 Source advisory: OSV:GHSA-QHXX-J73R-QPM2...

tensorflowjs (>=1.5.2 <=1.7.4) potentially affected by CVE-2020-15194 via tensorflow-cpu (=2.1.0)

tensorflow-cpu PYPI version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - tensorflowjs =1.5.2, =1.7.4 Source cves: CVE-2020-15194 Source advisory: OSV:PYSEC-2020-274...

tensorflowjs (>=1.5.2 <=1.7.4) potentially affected by CVE-2020-15203 via tensorflow-cpu (=2.1.0)

tensorflow-cpu PYPI version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - tensorflowjs =1.5.2, =1.7.4 Source cves: CVE-2020-15203 Source advisory: OSV:PYSEC-2020-283...

tensorflowjs (>=1.5.2 <=1.7.4) potentially affected by CVE-2020-15207 via tensorflow-cpu (=2.1.0)

tensorflow-cpu PYPI version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - tensorflowjs =1.5.2, =1.7.4 Source cves: CVE-2020-15207 Source advisory: OSV:PYSEC-2020-287...

tensorflowjs (>=1.5.2 <=1.7.4) potentially affected by CVE-2020-15204 via tensorflow-cpu (=2.1.0)

tensorflow-cpu PYPI version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - tensorflowjs =1.5.2, =1.7.4 Source cves: CVE-2020-15204 Source advisory: OSV:PYSEC-2020-284...

tensorflowjs (>=1.5.2 <=1.7.4) potentially affected by CVE-2020-15202 via tensorflow-cpu (=2.1.0)

tensorflow-cpu PYPI version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - tensorflowjs =1.5.2, =1.7.4 Source cves: CVE-2020-15202 Source advisory: OSV:PYSEC-2020-282...

tensorflowjs (>=1.5.2 <=1.7.4) potentially affected by CVE-2020-15206 via tensorflow-cpu (=2.1.0)

tensorflow-cpu PYPI version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - tensorflowjs =1.5.2, =1.7.4 Source cves: CVE-2020-15206 Source advisory: OSV:PYSEC-2020-286...

tensorflowjs (>=1.5.2 <=1.7.4) potentially affected by CVE-2020-15210 via tensorflow-cpu (=2.1.0)

tensorflow-cpu PYPI version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - tensorflowjs =1.5.2, =1.7.4 Source cves: CVE-2020-15210 Source advisory: OSV:GHSA-X9J7-X98R-R4W2...

tensorflowjs (>=1.5.2 <=1.7.4) potentially affected by CVE-2020-15211 via tensorflow-cpu (=2.1.0)

tensorflow-cpu PYPI version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - tensorflowjs =1.5.2, =1.7.4 Source cves: CVE-2020-15211 Source advisory: OSV:GHSA-CVPC-8PHH-8F45...

tensorflowjs (>=1.5.2 <=1.7.4) potentially affected by CVE-2020-15208 via tensorflow-cpu (=2.1.0)

tensorflow-cpu PYPI version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - tensorflowjs =1.5.2, =1.7.4 Source cves: CVE-2020-15208 Source advisory: OSV:GHSA-MXJJ-953W-2C2V...

tensorflowjs (>=1.5.2 <=1.7.4) potentially affected by CVE-2020-15190 via tensorflow-cpu (=2.1.0)

tensorflow-cpu PYPI version =2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow-cpu and may be impacted: - tensorflowjs =1.5.2, =1.7.4 Source cves: CVE-2020-15190 Source advisory: OSV:GHSA-4G9F-63RX-5CW4...